The cost of implementing a security control should not exceed the:

annualized loss expectancy. 

cost of an incident. 

asset value. 

implementation opportunity costs.