Certified Information Security Manager (CISM)Information Security GovernanceHard
A CISO is tasked with evaluating the effectiveness of the organization's current information security program. The board of directors is particularly interested in understanding the return on investment (ROI) of security expenditures. Which of the following metrics would be MOST appropriate for demonstrating the financial value and effectiveness of the security program to the board?
- AReduction in potential financial losses from avoided security incidents.
- BNumber of security awareness training sessions conducted annually.
- CMean time to resolution (MTTR) for critical security incidents.
- DPercentage of systems compliant with internal security standards.
Show answer & explanationAnswer & explanation
Correct answer: A. Reduction in potential financial losses from avoided security incidents.
To demonstrate ROI and financial value, metrics must quantify security's impact on the bottom line. Reduction in potential financial losses from avoided incidents directly translates security efforts into monetary terms that the board understands as value and return on investment. This requires estimating potential losses and showing how security mitigated them.
Why the other options are wrong
- B. This is an activity metric, not directly demonstrating financial value or ROI.
- C. MTTR is an operational efficiency metric, but it doesn't directly quantify financial value or ROI.
- D. Compliance is important, but it doesn't directly translate into financial value or ROI for the board.
Measuring InfoSec ROI
The process of quantifying the financial benefits derived from information security investments, demonstrating their value to the organization's profitability and risk reduction.
- Requires translating security outcomes into monetary terms.
- Often involves calculating avoided losses or improved operational efficiency.
- Crucial for justifying security budgets and strategic investments.
Memory trick: Show the board how many coins security keeps in the company's vault.