Telling Your Value Story

- 

Today, we witness an increasing number of cyber incidents across all industry domains. Boards of directors and senior management are educating themselves on their organisation’s risk exposure to these cyber-related issues. Boards also are seeking a better understanding of the potential for cybersecurity initiatives to enhance their company’s strategic operations. Many board members have questions for their security staff such as, “How secure are we from a particular threat?” or “Can you promise me we won’t be the next [hacked company]?” Security professionals need to be able to answer these questions and help board members understand that cybersecurity does not control the threat landscape facing the company. Instead, the purpose of a mature cybersecurity programme is to provide the business with a platform to manage its risk environment. 

A company’s senior management is often responsible for the development of a clear, concise strategy to address threats and vulnerabilities to cyber attacks. The chief information security officer (CISO) is expected to have technologies and security controls in place that reduce the organisation’s risk, as well as processes to monitor the effectiveness of the security programme. It is standard best practice to use a risk management framework, such as NIST CSF, ISO 27001 or COBIT 5, as a platform to establish the current risk baseline. With this platform, selected metrics are chosen as real-time measuring devices to provide visibility into the value being provided to the company.