Cybersecurity resources have been under constant pressure from their management to secure the infrastructure even though threat actors utilize advanced threat methods. Hence, to reduce their stress and potentially burnout, CISOs should take steps that will enable them to effectively measure the performance of the cybersecurity team.
Organizations these days are constantly under threats from emerging cyber-attacks. As per Verizon’s 2021 Data Breach Investigation Report, 70% of breaches that occurred this year were caused by outsiders, 45% involved hacking, 86% were financially motivated, 17% involved some form of malware, and 22% featured phishing or social engineering. Additionally, IBM’s “Cost of Data Breach Report 2020”, takes 280 days to find and contain the average cyber-attack, while the average attack costs $3.86 million. These stats highlight how vulnerable many firms are when considering their cybersecurity infrastructure. Furthermore, it shows that the teams responsible for protecting the infrastructure are in a tough spot.
With today’s cybersecurity professionals continued to be overwhelmed with responsibilities due to the remote and hybrid workforce, it is hard to understand for CISOs and their counterparts whether their security posture is being maintained or let alone be improved. For CISOs aiming to drive improvements, enhance their cybersecurity practices and keep their top talent to themselves, they should emphasize creating an effective team performance management. Not only will this enable CISOs to effectively measure the performance of their cybersecurity team, but it will empower them to foster a culture where ideas and innovation thrive.
Also Read: How CISOs Can Help the Information Security Team Beat Burnout
Here are five steps for CISOs to effectively measure the performance of their cybersecurity team:
-
Dig deeper into the role of each member
As per the National Institute of Standards and Technology (NIST), there are 52 specialists areas and responsibilities the comprise cybersecurity. There are workforce categories such as operate, maintain, protect and defend that also have specialty areas within each one and then work roles within those.
Even though it seems overwhelming, the guide from NIST provides a comprehensible description of responsibilities for each one of them and further separates these via KSAs (knowledge, skills, and abilities).
With the requirements for cybersecurity are distinct from business to business, many organizations may have individuals that may be covering multiple NIST-defined roles. Hence, before embarking on developing a robust performance management program, CISOs should delve into the NIST framework and identify where each member of their sits within the organization.
-
Put clear objectives in place
One of the challenges CISOs encounter when creating their performance management framework is not able to have clear objectives in place since it is difficult to define what success will look like. Using definitions as a foundation from NIST, CISOs can establish what responsibilities should be expected from every employee. This will allow them to view how their staff excels and what is expected of them at every level towards their progression. CISOs can opt for OKRs (objectives and key results) that will allow them to easily set SLAs for each team member and what steps they can take to meet them.
Also Read: IT Security Compliance: Strategies to Maximize ROI and Benefits
-
Taking care of the employees well being
Even though the NIST framework is remarkably thorough, it does not consider how roles within the team are affected by constraints such as pressure from the organization, team size, or technology available at their disposal. With burnout being a huge problem as cybersecurity staff members are under constant pressure, CISOs should ensure that they set the right target so that the team members will not feel overwhelmed.
Since cybersecurity is continuously evolving, CISOs should be flexible with their performance management plan. CISOs should have open communication with their team members as this will enable them to understand their challenges and provide opportunities to enhance the framework.
For more such updates follow us on Google News ITsecuritywire News
