Articulating The Business Value Of Information Security

Many CISOs struggle to articulate the value of their security programs and justify the security budget to business and executive management. This problem was acutely evident in the current economic downturn: Many security managers saw their budgets slashed, their projects postponed, and their employees laid off. CISOs have always struggled to effectively communicate the value of information security to business, but now there is a lot more at stake if they don't. Working closely with top CISOs at large, global organizations, Forrester has identified five areas of value for the business: reputation, regulation, revenue, resilience, and recession. Depending on your audience, we recommend that you use all or a combination of these business value propositions to make the case for continued investment and maybe even an increase in your security spending.