A Performance Assessment Metric for Information Security Financial Instruments