Add control cost / benefit fields to support treatment decisions

[JohnASRG]

Motivation

controls[] and riskTreatmentDecisions[] currently support implementation status and justification text, but no structured economic context. Real treatment decisions weigh implementation cost, lifecycle cost, and treatment benefit — all important inputs to risk acceptance discussions. Adding optional structured fields makes those tradeoffs portable across tools.

Proposed change

On controls[]:

• implementationEstimate: { amount, currency, basis: "engineering-hours"|"capex"|"opex"|"composite" }
• lifecycleCost: same shape, period: "annual"|"total-of-ownership"
• implementationOwnerPartyRef (uses parties[] from Add distributed cybersecurity activities and supplier responsibility model #58)

On riskTreatmentDecisions[]:

• treatmentBenefitRationale
• expectedRiskReduction: { from: bandBefore, to: bandAfter, confidence }
• decisionCostRationale

All fields optional; existing examples continue to validate without modification.

References

• AI peer review, "Open topic — Controls cost" and "Recommended backlog"

Acceptance criteria

• Schema fields added (JSON + XSD)
• Example demonstrates a control with implementation estimate and a treatment decision with expected risk reduction
• Methodology note explains that monetary values are advisory only

---

Surfaced by external AI peer review; see chat transcript for full review text.

[mmoseritemis]

As a fully optional field I think this would work. I'm not sure how often it would actually get utilized in a real project, but this does cover an area that I could see users potentially wanting the standard to include