Build the baseline from real costs
Include recurring security services and averaged historical loss categories that are relevant to the site. Avoid combining one-time incidents with monthly values unless you intentionally average them over a defensible period.