Last Updated on February 6, 2024

How to Measure the Value of Information Security

The value preservation aspect of cybersecurity is obvious. Cybersecurity is the foundation of protecting sensitive data, mitigating cyber risk, ensuring regulatory compliance, and providing peace of mind to stakeholders.

Forward-thinking organizations also see—and leverage—the value creation aspect of a robust cybersecurity posture that aligns with business goals.

How does information security create value for the organization? And how can we best measure the return on security investments?

This post shares insights from an episode of The Virtual CISO Podcast featuring James Fair, Senior VP at Executech. Topics of discussion include:

• The cost of cybersecurity versus the cost of a data breach
• Cybersecurity budget trends and industry averages
• How compliance with cybersecurity regulations supports both preserves and creates business value

How do you track security ROI?

Tracking the return on cybersecurity investments is notoriously challenging. Much like auto insurance, businesses gain the most obvious value from cybersecurity as protection to soften the blow when something goes wrong.

When a data breach inevitably occurs, your cybersecurity controls are there to minimize data loss, downtime, and reputational impacts. In so doing, cybersecurity preserves money, productivity, revenue, and customer loyalty.

Businesses typically weigh these value preservation factors when balancing the pros and cons of cybersecurity investments. But cybersecurity also delivers value when there are no hackers in sight.

The value creation side of cybersecurity ROI

The value preservation aspects alone do not tell the whole story of cybersecurity ROI. Effective cybersecurity has the potential to create as much value as it potentially preserves.

There is growing competitive benefit in being able to prove that your organization is secure and compliant. For example:

• Provable security and compliance can help an organization win more customers in both the public and private sectors. Why do business with a firm that has no security credentials when you can choose a safer partner?
• Many enterprises require all their vendors to show provable security and compliance.
• Cyber liability insurance costs are often lower when businesses employ specific security controls like multifactor authentication (MFA) and encryption. Certification against a comprehensive, trusted framework like ISO 27001 is also help reduce cyber insurance premiums.

Choosing the cybersecurity controls that will deliver top ROI

The ability to demonstrate cybersecurity and compliance best practices will help businesses build value, reputation, and their customer lists.

But that doesn’t make every cybersecurity tool a good investment. Weigh your risks against options for mitigating them to optimize protections for your specific needs.

By carefully selecting the best cybersecurity options and systems to implement within the context of your business, you can create value through competitive differentiation while optimizing the associated financial investment.

James Fair explains: “If you’ve got a list of possible attacks for your industry, an estimated likelihood of those attacks, and the severity in the event of such an attack, then you’ve got a matrix you can work with.”

Deciphering cybersecurity budgets

To create value from cybersecurity investments, you need to align your investments with business strategy and goals. For example, when you identify an ideal client for your products and/or services you can investigate their cybersecurity requirements and expectations for vendors.

It may not be necessary for your organization to become ISO 27001 certified or SOC 2 compliant if your customers do not require that level of data protection. However, if you plan to compete in regulated sectors like financial services or the US government supply chain, or if you provide cloud-based services, you may need to make greater investments and attain stronger security.

Regardless of what market(s) your business serves, your senior leaders must carefully analyze client, legal, and regulatory needs to outline an overall cybersecurity budget and how it can best be applied company-wide.

Cybersecurity investments do not always require achieving specific certifications. For example, your cybersecurity budget could be used to increase security awareness training, and/or test your current environment for vulnerabilities, if these results best support your business strategy and goals.

According to James Fair, “Your strategy needs to be prioritizing adaptability and confidentiality—privacy, safety, reliability, and upskilling leaders and security.”

Supporting cybersecurity ROI with compliance

Cybersecurity creates and preserves the most value when the organization verifiably complies with security regulations, practices, and expectations.

With the number of data breaches and their average cost to businesses continually increasing, and over 80% of US businesses admitting they’ve been hacked, achieving “continuous compliance is only becoming more critical. But it is essential to recognize that cyber compliance saves organizations time and resources when an attack occurs and delivers business value when all is well.

Cybersecurity measures often aim only to protect the organization from a breach, by focusing on how to keep the bad guys out. This gives too little focus to the portion of the plan that defines what should be done when attackers successfully get into your systems.

Creating a cybersecurity strategy that results in the most value creation requires a robust plan that considers all possible attack scenarios. Ensuring you have the most secure perimeter possible may help block attacks. But this approach should be paired with proactive controls, such as a Zero Trust architecture.

The best way to cover all bases in preventive and responsive cybersecurity planning is to implement widely used, researched, and endorsed best practices.

“Let’s make sure we’re also considering what happens when an attack happens, not only how we prevent it from happening,” says James Fair.

What’s next?

CBIZ Pivot Point Security relies on a proven process to help clients maximize the business value of their cybersecurity programs.

To connect with an expert about your business goals and how provable security and compliance can help, contact Pivot Point Security.