Making a case to the board

Proving security's worth is not always the easiest job. Once you've invested in systems, trained staff, secured the perimeter, secured the interior, put in monitoring and maintenance programmes, chosen what, if anything, to outsource, run penetration tests and more, what's the result? No-one gives out their password on the phone, catches a virus on their PC, leaves unencrypted data on the train or suffers any kind of a security breach. If all goes right, nothing happens.

Come the next budget round, though, the idea of giving money to a function that doesn't seem to produce any visible results may seem less palatable to the board than giving money to the sales department – particularly as the credit crunch makes cutbacks inevitable. So how should the information security head go about making the case for investing in security? And as those cutbacks start to bite, how can he or she make the money that is available go further?

As many CSOs have discovered, rather than talking ‘techie', using the same language as the rest of the business pays dividends. That might mean discussing return on investment (ROI) – or even ‘return on security investment' (ROSI) – but that approach has pitfalls.