 Quantitative risk analysis has been applied to IT security in a major US government study in 2000.The Federal CIO Council commissioned a study of the $100 million IT security investment for the Department of Veterans Affairs with results shown quantitatively.United States Department of Veterans Affairs

There are common vendor-neutral professional certifications for performing security assessment.