How do you get corporate funding for cybersecurity when it's so challenging to measure and report ROI to your C suite and board of directors?
This was one of the many topics discussed by chief information security officers on several panel sessions we attended last week at the RSA Conference in San Francisco.
During a session entitled "Aligning Cyber Security Personnel & Processes," Greg Schaffer, CISO of Circumference Group and a former Fidelity Investments CSO, summed up the dilemma this way: "The fact that you haven't had an incident is not an indication that you are secure. The fact that you have had an incident is not an indication that you're less secure."
How do you find the right metrics to report to your business-side executives? We can draw some lessons from the process outlined by Gary Gagnon, senior VP, CSO, and corporate director of cybersecurity for Mitre Corp. His team provides a monthly executive-level metric report featuring seven or eight briefing charts. He explained these charts and the information they show.
Read the rest of this article on Enterprise Efficiency.