CAN SECURITY PROGRAMS BE MEASURED?
The search for effective metrics has become an essential part of the management process in security as in other aspects of corporate life. Increasingly, security directors are asked to present metrics to senior management to establish a business case for undertaking security expenditures. “Unfortunately, the measures available for analyzing the effectiveness of corporate security tend to be much less sophisticated than those that have been developed for other corporate functions such as finance, human resources, and information technology,” says Cavanagh. Survey participants say the most useful metrics for determining the appropriate level of security spending in their companies are those that enable executives to determine how much a security problem would cost the firm in terms of liabilities or lost business. The most helpful metrics were the cost of business interruption, cited by 64% of executives; vulnerability assessments (60%); and benchmarking against industry standards (49%).
