A CISO is presenting the annual information security strategy to the board of directors. A board member questions the return on investment (ROI) of security expenditures, asking for a clearer business perspective. Which of the following metrics would BEST demonstrate the strategic value and ROI of the security program to the board?
- ACost of potential breach avoided due to implemented controls vs. security spend.
- BNumber of critical vulnerabilities identified and patched per quarter.
- CPercentage of employees who completed security awareness training.
- DMean Time To Detect (MTTD) and Mean Time To Respond (MTTR) to security incidents.
Show answer & explanationAnswer & explanation
Correct answer: A. Cost of potential breach avoided due to implemented controls vs. security spend.
Calculating the cost of potential breaches avoided due to implemented controls, compared to the security spend, directly demonstrates the financial return on investment. This translates technical security efforts into tangible business value by showing how security expenditures prevent significant financial losses, aligning with the board's focus on ROI and strategic value.
Why the other options are wrong
- B. While important for operational effectiveness, this metric doesn't directly translate to financial ROI or strategic business value for the board.
- C. This is a compliance or awareness metric, not one that directly quantifies financial return on security investment for the board.
- D. These are operational efficiency metrics for incident response, not direct measures of strategic value or financial ROI for the entire security program.
Measuring InfoSec ROI
The process of quantifying the financial benefits and value generated by information security investments, typically by comparing avoided losses (due to breaches, downtime, etc.) against the costs of security controls and programs.
- Translates security into financial terms for stakeholders.
- Demonstrates strategic value beyond mere cost.
- Essential for justifying budget and gaining executive buy-in.
Memory trick: Show them the money saved, not just the money spent.