Certified Information Security Manager (CISM)Information Security Risk ManagementHard
A Chief Information Security Officer (CISO) is presenting the information security program's progress and effectiveness to the board of directors. The board is primarily interested in understanding the financial impact of security investments and how they contribute to the organization's bottom line. Which metric would be MOST effective for the CISO to use to demonstrate the financial value of security initiatives?
- ANumber of vulnerabilities identified and remediated per quarter.
- BReturn on Investment (ROI) for security projects, adjusted for risk.
- CCompliance adherence rates with regulatory requirements.
- DMean Time To Detect (MTTD) and Mean Time To Respond (MTTR) for incidents.
Show answer & explanationAnswer & explanation
Correct answer: B. Return on Investment (ROI) for security projects, adjusted for risk.
The board of directors is typically focused on financial performance and strategic value. Risk-adjusted ROI for security projects directly translates security investments into financial terms, showing how they either save money (by preventing losses) or enable business growth, which is highly relevant to board-level discussions.
Why the other options are wrong
- A. This is an operational metric that doesn't directly convey financial value to the board.
- C. While important, compliance adherence is a regulatory metric; it doesn't inherently demonstrate the financial return or strategic value of security investments in monetary terms.
- D. These are incident response metrics, useful for security operations but not primarily for demonstrating financial value to the board.
Risk-adjusted ROI for Security
A financial metric that quantifies the return on investment for security initiatives, factoring in the reduction of potential losses (risk mitigation) and the cost of the security controls.
- Demonstrates financial value of security.
- Relevant for executive and board-level reporting.
- Considers both cost of control and averted loss.
Memory trick: Board cares about ROI, especially when risk is involved.