A Nontraditional Approach to Prioritizing and Justifying Cybersecurity Investments

摘要

The credibility, accuracy and overall success of a nontraditional ROSI methodology depends greatly on management participation in and support of such initiatives, the experience and discretion of company management participating in the workshop, the acceptance of reaching decisions via collaborative efforts in a management workshop forum, and the broad acceptance of the nontraditional ROSI approach. Detailed information is not required to carry out the analysis and conclusion of the ROSI process and justification of cybersecurity initiatives. The approach is a process that can assist company management in performing business analysis and justification based on company objectives and business processes and easily link cybersecurity to enterprise governance. Management can make great use of this process by determining investment opportunity contributions, payback and priority for each one of the business objectives. The outcome of this methodology serves as a guide for investment and allocation of resources such as investment capital and HR. In addition, this proposed methodology helps ensure that management has communicated and developed a consistent understanding of rationale and support to approve and implement cybersecurity initiatives.