Assessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.