Research by the ISF has found that many CISOs are reporting the wrong key performance indicators (KPIs) and key risk indicators (KRIs). Durbin attributes this to the fact that most CISOs have little or no interaction with the audiences to whom they report. As a result, they are guessing at what their audiences need and miss the mark when attempting to provide ongoing management reporting on topics like information security effectiveness, organizational risk and information security arrangements. “If I don’t know what you’re doing, how can I help you? I’m going to make some assumptions about what you’re doing and I could be completely wrong,” Durbin says. “Security guys are always talking about cost. If we realign this, the security guys can now go to the business and say, ‘look, if this is what is important to you, this is the role I can play in helping you protect that, but I don’t have the funding for a variety of reasons.’ The business can then make the call as to whether to find the funding for that problem. It’s no longer the security guy’s problem, it’s the business’s problem.”
4 steps to KPIs and KRIs
To help security departments find that common focus with the business, the ISF has developed a four-phase, practical approach to developing KPIs and KRIs. Durbin says this approach will help the information security function respond proactively to the needs of the business. The key, he says, is to have the right conversations with the right people. The ISF’s approach was designed to be applied at all levels of an organization and consists of four phases: At the heart of the ISF’s approach is the idea of engagement. Engagement builds relationships and improves understanding, allowing the CISO and the security function as a whole to better respond to the needs of the business. As an added bonus, it tends to open doors, allowing the CISO to have influence beyond just reporting.
Engagement begins with the right data
Engagement starts with establishing relevance. In the ISF’s approach, that means getting the right data, calibrated and supported by the right structures for the right audiences. That data must then be used consistently across the organization. Establishing relevance takes six steps, according to the ISF: Once you have the data, you need to generate insight from it. The ISF says reliable insights come from understanding KPIs and KRI. Generating insights involves the following three steps: With the insights in hand, it’s time to create impact, ensuring that information is reported and presented in a way that is accepted and understood by all involved. This leads to decision and action, as follows: The final step is to develop learning and improvement plans based on everything learned from the previous steps. This, according to the ISF’s approach, will lead to informed decisions based on an accurate view of performance and risk, giving organizations assurance that the CISO and information security function are responding proactively to priorities and other needs of the business. “Now that cybersecurity has the attention of the board, and information risk is on the agenda, CISOs are being asked increasingly tough questions about security investment and risk,” Durbin says. “It has never been more important for CISOs to be ready to answer these questions and articulate how the information security function is contributing to strategic priorities while helping to balance information risk.”
