Implement and Optimize an Effective Security Management Metrics Program
Your Challenge
- Security investments, requiring time and money, are often made without adequate supporting information as to the relative benefit of one investment vs. another.
- Many organizations and subject matter experts recognize the difficulty of establishing and maintaining an effective metrics program. This results in an inability to acquire management/leadership support for changes or additions needed for the security technology, policy, and process environment.
- In a resource-constrained environment, availability of additional resources for investment will be limited without solid evidence. Metrics allow the organization to understand its current state and highlight unnecessary risks and opportunities to reduce those risks.
Our Advice
Critical Insight
- Value vs. effort: The success of a metrics program is largely due to understanding the difference between quality and quantity. Attempting to measure anything and everything is not an efficient use of staff time and creates the potential for inconsistent measurements. For the most efficiency, devote your time to knowing what metrics will be provided to your organization, as well as assurance of their relevance, reliability, and reproducibility.
- Metrics are a journey, not a destination: An effective metrics program takes time. Identifying which stage your organization is at in terms of your metrics needs – minimum, recommended, or advanced metrics – allows you to prioritize which metrics you need to measure now and how your organization can continue to mature in metrics.
- Justify the spend: Use metrics to support your security investments with tangible, quantitative evidence. Communicate with management and facilitate decision making with objective benefits, rationales, and risks to back funding of security controls. Metrics can be used to prove which investments are worthwhile to the organization.
Impact and Result
- Short term: Streamline your program. Based on your organization’s specific requirements and risk profile, figure out what metrics are best for now while also planning for future metrics as your organization matures. Choose metrics that focus on overall business impact and provide the most actionable insight, rather than numbers for the sake of numbers.
- Long term: Once the program is in place, improvements will come with increased visibility into operations. Investments in security will be encouraged with more evidence available to executives, contributing to improved security posture overall. Potential for eventual cost savings also exists as there is more informed security spend and fewer incidents.
För tillgång krävs att du är inloggad med aktivt abonnemang.
Login/Subscription required.
Login/Subscription required.
MORE MATERIAL
Find other templates and tools
15.000 strategy documents, models, tools and frameworks
In our ambition to offer our customers an even greater value locally and globally, Radar has established a close collaboration with the global company InfoTech Research Group. The collaboration gives our subscribers at no additional cost, access to more than 15,000 strategic documents, models, frameworks and tools in fifty different IT Best Practice areas. You can read more (swedish) here.
NEED HELP?
Contact us for assistance
How do I get access to the material
All documents and templates are available for direct download through the portal – like other analyzes and reports. Access requires active subscription. The portal is supplemented regularly with new material. If you do not find what you are looking for, please contact us via the form or use our on-line chat.
Access to the material falls under Radars subscription!