When developing a business case for updating a security program, the security program owner MUST...

When developing a business case for updating a security program, the security program owner must identify relevant metrics that can help to measure and evaluate the performance and the effectiveness of the security program, as well as to justify and support the investment and the return of the security program. A business case is a document or a presentation that provides the rationale or the argument for initiating or continuing a project or a program, such as a security program, by analyzing and comparing the costs and the benefits, the risks and the opportunities, and the alternatives and the recommendations of the project or the program. A business case can provide some benefits for security, such as enhancing the visibility and the accountability of the security program, preventing or detecting any unauthorized or improper activities or changes, and supporting the audit and the compliance activities. A business case can involve various elements and steps, such as:

Problem statement, which is the description or the definition of the problem or the issue that the project or the program aims to solve or address, such as a security gap, a security threat, or a security requirement.

Solution proposal, which is the explanation or the demonstration of the solution or the approach that the project or the program offers or adopts to solve or address the problem or the issue, such as a security tool, a security process, or a security standard.

Cost-benefit analysis, which is the calculation or the estimation of the costs and the benefits of the project or the program, both in quantitative and qualitative terms, such as the financial, operational, or strategic costs and benefits, and the comparison or the evaluation of the costs and the benefits, to determine the feasibility and the viability of the project or the program.

Risk assessment, which is the identification and the analysis of the risks or the uncertainties that may affect the project or the program, both in positive and negative terms, such as the threats, vulnerabilities, or opportunities, and the estimation or the evaluation of the likelihood and the impact of the risks, to determine the severity and the priority of the risks, and to develop or implement the risk mitigation or the risk management strategies or actions.

Alternative analysis, which is the identification and the analysis of the alternative or the comparable solutions or approaches that may solve or address the problem or the issue, other than the proposed solution or approach, such as the existing or the available solutions or approaches, or the do-nothing or the status-quo option, and the comparison or the evaluation of the alternative solutions or approaches, to determine the advantages and the disadvantages, the strengths and the weaknesses, and the pros and the cons of each alternative solution or approach.

Recommendation, which is the suggestion or the endorsement of the best or the preferred solution or approach that can solve or address the problem or the issue, based on the results or the outcomes of the previous elements or steps, such as the cost-benefit analysis, the risk assessment, or the alternative analysis, and the justification or the support of the recommendation, by providing the evidence or the data that can validate or verify the recommendation.

Identifying relevant metrics is a key element or step of developing a business case for updating a security program, as it can help to measure and evaluate the performance and the effectiveness of the security program, as well as to justify and support the investment and the return of the security program. Metrics are measures or indicators that can quantify or qualify the attributes or the outcomes of a process or an activity, such as the security program, and that can provide the information or the feedback that can facilitate the decision making or the improvement of the process or the activity. Metrics can provide some benefits for security, such as enhancing the accuracy and the reliability of the security program, preventing or detecting fraud or errors, and supporting the audit and the compliance activities. Identifying relevant metrics can involve various tasks or duties, such as:

Defining and documenting the objectives, scope, criteria, and methodology of the metrics, and ensuring that they are consistent and aligned with the business case and the security program.

Selecting and collecting the data or the evidence that are related to the metrics, using various tools and techniques, such as surveys, interviews, tests, or audits.

Analyzing and interpreting the data or the evidence that are related to the metrics, using various methods and models, such as statistical, mathematical, or graphical methods or models.

Reporting and communicating the results or the findings of the metrics, using various formats and channels, such as reports, dashboards, or presentations.

Preparing performance test reports, obtaining resources for the security program, and interviewing executive management are not the tasks or duties that the security program owner must do when developing a business case for updating a security program, although they may be related or possible tasks or duties. Preparing performance test reports is a task or a technique that can be used by the security program owner, the security program team, or the security program auditor, to verify or validate the functionality and the quality of the security program, according to the standards and the criteria of the security program, and to detect and report any errors, bugs, or vulnerabilities in the security program. Obtaining resources for the security program is a task or a technique that can be used by the security program owner, the security program sponsor, or the security program manager, to acquire or allocate the necessary or the sufficient resources for the security program, such as the financial, human, or technical resources, and to manage or optimize the use or the distribution of the resources for the security program. Interviewing executive management is a task or a technique that can be used by the security program owner, the security program team, or the security program auditor, to collect and analyze the information and the feedback about the security program, from the executive management, who are the primary users or recipients of the security program, and who have the authority and the accountability to implement or execute the security program.