Comparing programs can yield rewards

摘要

There are questions any CISO is bound to get asked: "How do we stack up against our industry peers?" or "How does our spending on security compare to our peers?" These are questions that cut right to the heart of our programs, and are unfortunately the most difficult to answer. We all know what we spend internally, but how do we get reliable, timely information for comparison purposes?