How to Connect Cyber Investment to Outcomes

Most agree cybersecurity is an important priority for any agency or business, but it’s often difficult to prove that’s the case using hard data. It’s much easier for organizations to acknowledge the overall value of cyber risk management than to chart that value in terms of specific organizational goals, budgets and revenue.

Thankfully, that overall value is becoming easier to quantify, as the National Institute for Standards and Technology's Cybersecurity Framework is helping codify standards, guidelines and best practices on flexible and cost-effective steps for protection and resilience amid cyber threats.

Still, a recent experience I had discussing this topic with a room full of executives reminded me just how eager the business community remains in trying to connect the dots between cyber risk investment and concrete business outcomes.

I was giving a talk at a George Mason University forum near Washington D.C. about cybersecurity governance and leadership. One slide in particular—judging by the amount of questions and follow-up conversations it prompted—seemed to stand out. It was a grid of itemized security investments and how those investments related to specific Cybersecurity Framework-related business functions and priorities. It was, in other words, taxonomy for tying particular cybersecurity investments to particular value streams in the organization.

Security Investment and Value Chains

As it happens, the value matrix that so intrigued my GMU audience originated in the form of a gauntlet thrown down a few months earlier by my cheif executive officer. As I had enthusiastically informed him that we had received our ISO 27001 certification, he probed, “So, how does this actually benefit the business?”  

His question was a shrewd one that seized on an important challenge: The value of risk management is not self-evident. It needs to be justified with metrics and explained throughout the organization—from the server room to the boardroom. My response was to work up that value matrix to connect those dots.

Whether you develop your own value matrix or try some other approach, your goal should be to draw clear lines: how this particular security investment deals with that particular control; how that control impacts our risk posture in this particular category; and how all this ultimately serves a particular business function.

Perhaps you track how a granular requirement ties to a business function. Or maybe you employ a heat map to see how investments benefit your risk posture in a certain area from year to year. Regardless of your particular approach, the goal is to get more clarity on how security investments are affecting the bottom line and ultimately benefitting the business.

Today’s Best Practices Are Tomorrow’s Regulatory Requirements

Some of what I’m saying may sound forward-thinking, but the truth is that regulatory requirements and standards are always changing, and the bar for documenting security impact and effectiveness is getting higher.

For instance, government contractors operating under NIST 800-171 already have to demonstrate strict security compliance or they risk losing their contracts. And in a sign of things to come, rigorous data protections in the European Union called the General Data Protection Regulations, which take effect today, could increasingly serve as a template for U.S. regulations in the future.

Today’s best practices, in other words, may become tomorrow’s compliance requirements. That’s why it’s crucial for organizations to do a better job of tracking and demonstrating the value of their security investments.

Cyber risk management is important for every organization—public and private sector. As the Cybersecurity Framework continues to evolve as a road map for security strategy, public agencies and private companies alike must continually refine their ability to chart the impact of those investments. And they should do this not merely as a compliance requirement, but as a true and demonstrated driver of value and growth in the organization.

Richard Tracy is the chief security officer of Telos Corporation.