Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Demonstrating Value and Return on Security Investment
Is security worth it?
Executives ask the same question of security as of any other spending: what do we get for it? Value delivery, one of the six outcomes of security governance, means security investments are worth what they cost. Because security’s main benefit is things that don’t happen, the answer needs both numbers and a clear story.
Return on security investment
Return on security investment (ROSI) uses the annualised loss expectancy (ALE), covered in detail in Domain 2:
ROSI = (ALE before − ALE after − annual cost of control) ÷ annual cost of control
| Step | Value |
|---|---|
| Expected yearly loss from phishing fraud today (ALE before) | 400,000 |
| Expected yearly loss with the new control (ALE after) | 100,000 |
| Reduction in annual loss | 300,000 |
| Annual cost of the control | 100,000 |
| ROSI | (300,000 − 100,000) ÷ 100,000 = 200% |
A positive ROSI means the control saves more than it costs. A control that costs more than the loss it prevents is rarely justified, unless a law or contract requires it.
Handle estimates honestly
ROSI is only as good as its inputs, and loss and likelihood are estimates. To keep credibility:
- show the assumptions behind the figures
- use ranges (best, likely and worst case) rather than one precise number
- use internal incident data and published industry loss studies
- agree the assumptions with finance before presenting
Value beyond money
| Value | Example |
|---|---|
| Customer trust | Certifications and a good security record win and keep customers |
| Regulatory standing | Fewer findings, lower fines, smoother inspections |
| Enablement | Safe cloud adoption, new digital products, faster delivery |
| Insurance | Better controls can lower cyber insurance premiums, or make cover available at all |
Showing value over time
Report measures that link security to business outcomes, regularly, so value is visible before anyone asks.
Example. A CISO reports: fraud losses down 60% since customer MFA; two enterprise deals won that required ISO 27001; the cyber insurance premium cut by 15% after an endpoint detection rollout; no regulator findings in this year’s inspection.
Counting “attacks blocked” or “alerts handled” shows activity, not value. Executives care about reduced business impact and enabled business.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Governance outcome about getting worth from security spend | Value delivery |
| When is a control cost-justified? | When the loss reduction exceeds its cost, or it’s required |
| Main weakness of ROSI | It relies on estimates of loss and likelihood |
| Best way to show value to executives | Metrics linked to business outcomes |
| Is security value only cost avoidance? | No; enablement and trust count too |
In short
- Value delivery, security investments being worth what they cost, is one of the six outcomes of security governance.
- Return on security investment (ROSI) = (reduction in annual loss expectancy − annual cost of the control) ÷ annual cost.
- ROSI depends on estimates of loss and likelihood; show assumptions and ranges rather than false precision.
- Much security value is non-financial: customer trust, regulatory standing, enabling new business, lower insurance premiums.
- Value is demonstrated through metrics tied to business outcomes, reported regularly.
- Spending more than a risk could ever cost is poor value, however good the control.
Exam traps
- A control costing more than the loss it prevents is rarely justified, unless law or contract requires it.
- Counting 'attacks blocked' isn't a measure of value; reduced business impact is.
- Security value isn't only cost avoidance; enablement counts too.
- Precise-looking ROSI figures built on guesses damage credibility when challenged.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Return on security investment