Call us now:
Herein lies a problem for security. The cyber debate has long been one of demonstrating tangible returns, be that for investors or CFOs in security tech or CFOs and investors in those companies that have to invest to demonstrate adequate cybersecurity.
The cybersecurity ROI debate is a continual one. In many ways one that has similarities to the quality debate that raged through manufacturing in the 1960s, 70s and early 80s. Where question over the ROI for implementing qualify management systems like SPC, Lean, Kaizen and Six Sigma raged. Until some companies took the lead and demonstrated that by adopting quality management, companies could improve productivity and efficiency.
The challenge that CISOs, CFOs and boards face today, has some similarities, with a few notable differences. Like quality was, cyber is treated as a cost, not an investment; Cyber is mis-understood and it’s been hard to demonstrate the value of cyber, ‘what do you mean I spend $XXX and you say I’m not going to be secure’; The RoI for cyber is impossible to quantify, as the tech industry, hackers, poor resourcing and poor knowledge and understanding don’t enable quantification. The biggest factor by any margin is that cyber is being regulated, and the cyber debate has moved from one of demonstrating RoI to demonstrating compliance. Cyber compliance is hard to avoid but one can demonstrate reasonable and adequate compliance. Reasonable and adequate can be aligned to financial performance to demonstrate compliance.
While the role of the CFO is important, the role of the board is more important. If boards don’t ‘get’ cybersecurity risk management and regulatory compliance then the CISO, and board, will be stuck between regulators and lawyers. At a time when ICT risk and cyber threat show no sign of diminishing. Boards need to demonstrate governance, oversight and assurance of cyber if they are going to demonstrate reasonable and adequate compliance, and a hope of demonstrating a return on their investment rather than cost.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7236671311157080064