Designing security architectures is not so difficult, providing you have a good road map. Policies and procedures within the organization are that road map to effective and efficient security designs. Risk Management is the bridge between the two. One huge element in the risk management process is determining the security return on investment (ROI). As the Security Manager for your firm, how do you justify security spending for firewalls, intrusion prevention systems, content filters, two-factor authentication systems, and so forth to business managers? Many managers see security spending as red ink on the ledger. In today's business environment, companies want or demand an ROI. This white paper discusses risk management as a key process in designing security architectures, including a better way for security managers to approach the security ROI issue.