All Articles

It is very important to properly define the right Information Security Metrics for an organization to estimate the security structure and to communicate it efficiently to the Board level executives.There is a growing interest from the Board and the CEO to understand the information security posture of the company. Many of the CISOs I know have been asked by the Board or the CEO to present. I also notice a huge disconnect between the security professionals in terms of what they think the Board want and the reality. From my experience of being a security professional as well as being a Board member (I need to manage my investors), I am attempting to structure my experience.

( Read more:  Free Resources For Kickstarting Your IT-GRC Program )

Key Considerations while presenting to the Board

• Less is more. Board doesn't want the technical details.
  
  We might want to fill up the presentation with a lot of information security metrics and data but the board wants the most critical ones which they can understand and relate to. E.g. They might not be interested in knowing about patching status or the number of incidents that you handled. 

• Board speaks a different language
  
  Understanding the language of the board is very important. Use technical jargon as sparingly as possible. Change your language and examples to something that the non security audience can easily relate to. One way to handle this is to link your information security metrics to the most important business critical systems
  
  For Example: Instead of providing only information security metrics link the story to what matters to the board. If collection of revenue is central to your sustainability then the "Billing system" gets attention.

• Board is worried about how good the security is....minus the technicalities
  
  That's a hard problem to answer. Security cannot be measured on absolute terms. However you got to explain it in simple way. Define your information security metrics to demonstrate your organization's security. You also need to assure how ready you are in terms of handling any critical incident

• Be cautious: Verify your assumptions
  
  A lot of times we assume that the board might be interested in certain things, this may not be true for critical information security metrics. Most of the time people guess it wrong. It is a good idea to assume but definitely verify and take feedback

( Read more: 10 questions to ask before you start your Bug Bounty program… )

List of To-Do before the Board Meeting

• Understand what the Board wants helps you define required information security metrics
• Understand the level of understanding of each individual in the board
• Align your security strategy & information security metrics to the Business Goals
• Use Real Life examples and stories which is contextually similar to your business
• Represent numbers or other complex stuff graphically which gives an idea of trend
• Be prepared with the synopsis of the key security projects running and the most vital ones needing approval
• Be prepared with security strategy in simple numbers eg. If scenario 1 happens, Loss=$5million
• References to stats and competing organizations is helpful

Recommended Board Level Information Security Metrics / Dashboard (Less is more)