Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A CISO is presenting to the board about the organization's information security program effectiveness. The board asks for a clear metric that demonstrates the financial benefit of security investments. Which of the following metrics would BEST address the board's request?
- ANumber of security incidents detected per month.
- BPercentage of employees who completed security awareness training.
- CMean Time To Recover (MTTR) from critical incidents.
- DReturn on Security Investment (ROSI).
Show answer & explanationAnswer & explanation
Correct answer: D. Return on Security Investment (ROSI).
Return on Security Investment (ROSI) directly quantifies the financial benefit of security investments by comparing the cost of security controls to the avoided losses (e.g., from incidents mitigated). This metric speaks directly to the board's concern about financial benefit and strategic value.
Why the other options are wrong
- A. This is an operational metric that shows activity, not direct financial benefit.
- B. This measures compliance with training initiatives, not the financial return of security spending.
- C. MTTR is a performance metric for incident response, not a direct measure of financial return on investment.
Return on Security Investment (ROSI)
ROSI is a metric used to quantify the financial benefits of information security investments by comparing the cost of security controls to the financial losses avoided due to those controls.
- Helps justify security spending.
- Calculated as: (Avoided Loss - Cost of Investment) / Cost of Investment.
- Provides a business-centric view of security value.
Memory trick: To show the money, you need to calculate the return.