Many CISOs are struggling to explain the value of security investments because of the communication gap, and if security professionals can’t communicate that value, they risk falling out of step with business priorities, giving leaders a false sense of security readiness, or managing misaligned expectations.
Today, with cybersecurity threats increasing, boards understand the need of engaging on the topic and are getting more knowledgeable about it. According to Gartner’s “2020 Board of Directors Survey”, 40% of boards of directors by 2025 will have a dedicated cybersecurity committee led by a qualified board member, up from fewer than 10% currently. However, there is still a disconnect between a security program’s daily metrics and the board’s priorities.
Also Read: Four Factors to Consider when hiring an MSSP
Translation errors
Fortunately, there are metrics that both teams understand and care about, so everyone can communicate in the same language—no interpreters required. These indicators generate insights that boards and security teams can use to collaborate and act on while considering people, processes, and technology.
Boards are responsible for approving an organization’s strategic direction, as well as how it allocates resources and manages risk. To make an effect at the board level, security leaders should deliver KPIs that are aligned with business objectives.
While these are metrics to avoid, there are others that matter to leadership and are understandable by a wider range of stakeholders than the security team. These metrics are concerned with the efficiency with which resources (such as security program technologies and people) are deployed, as well as ensuring that enterprises have the necessary visibility to minimize risk.
Effectiveness of the tool
Security professionals as well as board members should know if their security investments are paying off. They should measure criteria like the number of issues teams encountered while using current tools, the number of outages or inactive services, and the number of vendor support tickets to see if current tools are working. Also, businesses should keep track of how well the features and capabilities of each tool are integrated—this is an excellent indicator of tool ROI.
Also Read: Data Security Practices for a Permanent Hybrid Working Model
Teamwork and productivity
Organizations should consider how much time teams spend dealing with false positives, which can lead to fatigue, or troubleshooting and administering tools, as well as how quickly they respond to issues in the face of these distractions (using Mean Time to Respond, or MTR). Organizations can determine if they are sufficiently staffed or if a team requires more training by combining various team KPIs.
Organizations can seek out metrics from partners or research houses if the focus moves to metrics that provide the context in addition to numbers, especially if this involves finding peer or industry benchmarking statistics against which to compare a team’s performance. Of course, this is a difficult category to quantify, but it is critical because it is the “people” pillar.
Metrics that assess tool efficacy, visibility, and team performance are also critical to track overtime in order to get insight into trends—another important prerequisite for providing context to metrics. Ideally, businesses should be able to show how each investment in people, processes, and technology improved their security program and reduced risk. If such measurements can be shared, communication gaps will start to dissolve, and everyone will speak the same business language, ensuring that an organization’s security program is aligned with its business objectives and that it can focus on its primary mission.
For more such updates follow us on Google News ITsecuritywire News.
