The ROI Of Infosec: 11 Dos and Don’ts For Management Buy In

Do make it personal. It’s critical that CEOs and board members grasp the fact that they can be held criminally liable when something goes wrong – and things always go wrong; myriad attacks on your system occur every hour, at minimum. Only the damages vary. Systems and forensics must be in place demonstrating that everyone did their utmost to secure the information.

Do speak the same language. Listen and pay attention to how the CEO positions her priorities and requests. Mirror that language when you approach her.

Do offer a comprehensive view of corporate vulnerability. Data today is everywhere – network, cloud, mobile devices, remote employees, third party partners and service providers, etc. Clearly explain that security resources must be decentralized and cover everything If you protect your information in one area only, the attacker will find the weakest link and use that to reach everything.

Don’t portray IT security as a “complication.” Stress that while security is largely invisible, it is also a business enabler. Demonstrate how IT security facilitates operations, for example, policies within a classification system can ensure that everyone in the accounting department can access certain files and folders automatically without having to make change requests.

Do tie data security classification to expenses. A company’s ability able to find and classify the data will determine how it should be stored and the level of protection it requires. You may end up with a list that shows that only 10% of corporate data needs to be protected at the highest level, immediately reducing operating expenses and longer-term capital expenses.

Do more than simply present the CEO with a list of security vulnerabilities. Explain  the consequences of the vulns, in terms of legal issues, damage to reputation, fines, etc.

Don’t ignore the bottom line. You can  demonstrate the actual cost of security breaches with a quick Google search for recent examples. Here’s one at our fingertips: Target settled for $39 million to pay financial institutions affected by its breach.

Do remind upper management of your company’s legal obligations and how they are affected by security breaches. For example, your company probably agreed to multiple NDAs before business partners agreed to send you proprietary information. Should an outsider access that information from your internal systems, you’ve basically voided the NDA, opening you up to legal action.

Do review the statutes. Most companies are either obligated to follow SOX, PCI-DSS, NASD, SEC or other regulatory bodies. Compliance audits are a regular occurrence, and it is cheaper and easier to be in continual compliance than have to make corrections to integral corporate systems once you’ve failed the audit and are liable for massive fines. (Another ROI feature.)

Do create alliances within your organization to present “group” priorities. Pay particular attention to the corporate risk management team.

Do explain how data security is a critical part of supporting the employee relationship. Employers have access to employees’ healthcare records and personal family information, etc. If they become part of the public record it is a significant breach of trust. Employees can also sue you for putting them at risk of identity theft.