The figures in the enclosed report are a concern.

← Back to Blog

The figures in the enclosed report are a concern. If the average IT security spend per employee (maybe the best measure we have today) has remained flat for the past 6 years, its a good indicator that we are not moving forward to protect our digital assets. While the figure is a very blunt indicator and not indicative of specific industry spend (banks spend 3 times this), it could be used to demonstrate that we are standing still in advancing cybersecurity into organisations.

We used to measure IT spend as a percentage of revenue between 10%-15%. If IT security spend is 5% of this figure, that is a poor indicator of how well we are managing our cybersecurity and cyber-risk.

Cyber is not a technology problem and IT security spend will not solve it. Cyber is an enterprise wide business risk, and as the article discusses the board room needs to balance up the roles at the table including both the Chief Information Security Officer (CISO) and Chief Risk Officer (CRO). To close the inherent risk, residual risk gap.

‘Gartner projects that a single executive focused on security ¢â‚¬â€œ namely, the CISO ¢â‚¬â€œ will be insufficient for most large organizations as early as 2025.‚ 

Additional roles may include a chief risk officer, who manages the overall risk of business assets, or a cyber risk officer, who assesses risks such as breaches, data leaks, or cloud misconfigurations in the software products.’

A reason maybe why US regulators are focusing on cyber legislation and regulatory enforcement.

Ted Dziekanowski

#theaugustaplan‚ #cybersecurity‚ #cyberriskmanagement‚ #regulatorycompliance‚ #regulatoryoversight‚ #cybercompliance‚ #cyberregulation‚ #cybergovernance‚ #cyberriskgovernance‚ #ransomeware‚ #governance‚ #nist‚ #cyberinsurance‚ #insurance‚ #defence‚ #defense‚ #cni

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6903643002095689728