The cost of saying no.
Put a dollar figure on a security decision. Move the sliders to today's state, pin it, then move them to each alternative. Walk into the meeting with the table.
How exposed
The findings on the one system this decision is about. Watch which of these actually move the number.
Internet-facing systems are probed by automated exploitation continuously.
Who can reach this system once they are inside. Isolation changes how often it is attacked, not whether an attack works.
Changes how long a rebuild takes when the backups are gone — there is no supported path back.
How often
How many times a year a capable attacker gets a position from which this system can be attacked. Start from your incident history; nobody knows this better than a factor of two, and the model simulates it that way.
How bad
What a successful event costs, built from facts you already have rather than a guess.
Everything since the last good backup has to be re-keyed or is gone.
Intruders go after the backups before they detonate. Immutability is what defeats that.
Untested restores fail the first time more often than not.
The decision table
Pin the current state as "Do nothing", then move the sliders to each alternative and pin it with its cost. The options line up here, over your 3-year horizon, with the cost of saying no as a number.