Measuring Security Investments

The video features Mary Faulkner discussing the importance of measuring the effectiveness of security programs. She emphasizes the need for relevant metrics tailored to different audiences and the importance of frameworks like ISO and NIST. Faulkner advises involving various organizational departments in framework decisions and highlights the need for both quantifiable data and subjective observations. The session also covers the importance of moving beyond compliance to fully measure risks and demonstrates how to communicate value to leadership. Audience questions address budget considerations and effective communication strategies.

What are some key metrics that should be reported to the C-suite and board of directors?

How can organizations balance their cybersecurity budget with the need for effective threat mitigation?

What is the difference between return on investment and value of investment in cybersecurity?

What are some common data points that can be used to measure cybersecurity effectiveness?