The Importance of Outcome-Driven Metrics and Business Value Benchmarks are Being Discussed During the Gartner CFO & Finance Executive Conference
National Harbor, Md., May 21, 2024: With more executives identifying security as critical for enterprise revenue growth, the CFO needs to be comfortable handling cybersecurity investments that provide defensible performance and outcomes to business stakeholders, according to Gartner, Inc.
During the session, “CFO: Manage the Business Value of Cybersecurity Investments” at the Gartner CFO & Finance Executive Conference today, Paul Proctor, Distinguished Vice President Analyst at Gartner, explained to attendees how to develop an approach to cybersecurity that balances protection with running the business.
Paul Proctor said that CFOs need to find a cybersecurity posture they can defend to business stakeholders.
This enables CFOs to make informed cybersecurity investments that balance the need to protect and run their business while also better managing chief information security officer (CISO) demands for budget.
“Treating cybersecurity in a manner that reconciles measurable levels of protection with the needs of the business, which are called Protection-Level Agreement (PLA) decisions, creates a defensibility of their implementation,” said Proctor. “This kind of defined agreement leads to better cybersecurity investment decisions, better execution and a safer world overall.”
For example, instead of reporting on the number of attacks an organization receives, executives should report on the number of days to patch critical systems. This has a direct line of sight to the value proposition of patching, which is to limit the number of days a vulnerability is available for hacking. Then executives can weigh the cost of faster patching against the reduced risks to critical systems which is a business decision based on a measurable level of protection.
“If an organization’s PLA is for 30-day patching of critical systems, and those systems get hacked via an unpatched vulnerability after 35 days, that is a control failure: security and IT have failed to deliver on the agreement,” said Proctor. “However, if the same vulnerability is hacked in 25 days, that is as a result of a business risk decision: a concrete, measurable, enforceable assertion of risk-appetite.”
There are two measures of cybersecurity value, first is operational value delivery, and second is the target level of protection. Both are important to create defensibility for executives. Did they pick defensible targets? Did IT and security deliver their desired level of protection?
“The organization must make conscious decisions regarding what it will do, and more importantly, what it will not do to protect itself,” said Proctor. “Residual risk must be accounted for, and as the business grows, CISOs, CFOs and other executives must continually reassess how much risk is appropriate.”
