Numerous IS researchers have argued that IS Security can be more effectively managed if the emphasis goes beyond the technical means of protecting information resources. In an effort to adopt a broader perspective that accounts for issues that transcend technical means alone, Dhillon and Torkzadeh (2006) present an array of 9 fundamental and 16 means objectives that are essential for maximizing IS security in an organization. These objectives were derived using a value-focused thinking approach and are organized into a conceptual framework. This conceptual framework provides a rigorous theoretical base for considering IS security in a manner that accounts for both technical and organizational issues; however, no direction is provided for using these objectives so that informed decisions can be made. As a result, the goal of this dissertation is to develop a decision model using Multiple Objective Decision Analysis (MODA) techniques that seek to provide informed alternatives to decision makers who desire to maximize IS security within an organization.

A systematic customer value assessment process (CVAP) was developed to give system engineering teams the capability to qualitatively and quantitatively assess customer values. It also provides processes and techniques used to create and identify alternatives, evaluate alternatives in terms of effectiveness, cost, and risk. The ultimate goal is to provide customers (or decision makers) with objective and traceable procurement recommendations. The creation of CVAP was driven by an industry need to provide ballistic missile defense (BMD) customers with a value proposition of contractors’ BMD systems. The information that outputs from CVAP can be used to guide BMD contractors in formulating a value proposition, which is used to steer customers to procure their BMD system(s) instead of competing system(s). The outputs from CVAP also illuminate areas where systems can be improved to stay relevant with customer values by identifying capability gaps. CVAP incorporates proven approaches and techniques appropriate for military applications. However, CVAP is adaptable and may be applied to business, engineering, and even personal every-day decision problems and opportunities. CVAP is based on the systems decision process (SDP) developed by Gregory S. Parnell and other systems engineering faculty at the Unites States Military Academy (USMA). SDP combines Value-Focused Thinking (VFT) decision analysis philosophy with Multi-Objective Decision Analysis (MODA) quantitative analysis of alternatives. CVAP improves SDP’s qualitative value model by implementing Quality Function Deployment (QFD), solution design implements creative problem solving techniques, and the qualitative value model by adding cost analysis and risk assessment processes practiced by the U.S DoD and industry. CVAP and SDP fundamentally differ from other decision making approaches, like the Analytic Hierarchy Process (AHP) and the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS), by distinctly separating the value/utility function assessment process with the ranking of alternatives. This explicit value assessment allows for straightforward traceability of the specific factors that influence decisions, which illuminates the tradeoffs involved in making decisions with multiple objectives. CVAP is intended to be a decision support tool with the ultimate purpose of helping decision makers attain the best solution and understanding the differences between the alternatives. CVAP does not include any processes for implementation of the alternative that the customer selects. CVAP is applied to ballistic missile defense (BMD) to give contractors ideas on how to use it. An introduction of BMD, unique BMD challenges, and how CVAP can improve the BMD decision making process is presented. Each phase of CVAP is applied to the BMD decision environment. CVAP is applied to a fictitious BMD example.