Cost and Effectiveness of Information Security Controls

See more:

database

Hi

I am doing a project on Cost and Effectiveness of Information Security controls which must act like a guide for a small company having around 50 computers or less.

My question is

1. How can I find the differnet threats that a company will care about
2. What are the Risk Exposures that a company will consider
3. What are the Architectural Recommendations that a company will follow.. like the cost of the firewalls, antivirus etc., how can I get those details
4. what are the policy recommendations

I desperatively needed these details to complete my project.
Can you please help me in getting those details, it can help me great if the details are of a active software company else tell me the sources where I can get this information.
I will be thank full if you provide these details

thank you
sravan