- So the real question is: can finance leaders defend the choices they have made on cybersecurity to their key stakeholders?
Chief finance officers (CFO) need to be comfortable handling cybersecurity investments that provide defensible performance and outcomes to business stakeholders, an industry expert said.
Paul Proctor, Distinguished Vice President Analyst at Gartner, said that CFOs need to find a cybersecurity posture they can defend to business stakeholders, to regulators, to employees, customers, and partners, in the event of an incident.
“There is no such thing as perfect protection. No matter how much an organisation spends, it can still get hacked the next day, so the real question is: can finance leaders defend the choices they have made on cybersecurity to their key stakeholders?”
He said the best way to do this is to treat cybersecurity as a business investment, which means that CFOs need to determine the business value of cybersecurity using outcome-driven metrics and a business value benchmark.
Critical step
“The emergence of protection level benchmarks is a critical step in the development of a cybersecurity standard of due care,” Proctor said.
This enables CFOs to make informed cybersecurity investments that balance the need to protect and run their business while also better managing chief information security officer (CISO) demands for budget.
“Treating cybersecurity in a manner that reconciles measurable levels of protection with the needs of the business, which are called Protection-Level Agreement (PLA) decisions, creates a defensibility of their implementation,” Proctor said.
“This kind of defined agreement leads to better cybersecurity investment decisions, better execution and a safer world overall.”
Instead of reporting on the number of attacks an organisation receives, he said that executives should report on the number of days to patch critical systems. This has a direct line of sight to the value proposition of patching, which is to limit the number of days vulnerability is available for hacking.
Then executives can weigh the cost of faster patching against the reduced risks to critical systems which are a business decision based on a measurable level of protection, he said.
There are two measures of cybersecurity value, he said, first is operational value delivery, and second is the target level of protection.
“Both are important to create defensibility for executives. Did they pick defensible targets? Did IT and security deliver their desired level of protection?”
“The organisation must make conscious decisions regarding what it will do, and more importantly, what it will not do to protect itself. Residual risk must be accounted for, and as the business grows, CISOs, CFOs and other executives must continually reassess how much risk is appropriate,” Proctor said.