Q. What metrics system might an executive use to monitor the strategies of a business?
A. I will assume you are asking specifically about security executives given this Q&A's topic area. There are many metrics that can be used (in fact we have identified 375. See the description of our book we published, Measures and Metrics in Corporate Security. However, the issue many security practitioners incur is a) not measuring at all or b) measuring things by simply counting them (e.g., workplace violence incidents or lost laptops), rather than demonstrating the value Security brings to the business. By way of example, convey savings to the company by your program's reduction of workplace violence issues (the cost of managing an event and lost employee time; or cost savings by reducing any potential acts because of your background due diligence program).
Unfortunately, there are no measures and metrics standards in security because factors vary widely; for example, type of industry, size of company, corporate culture, level of regulatory pressure, etc. However, the Security Executive Council created a tool to help security executives understand and communicate what they are doing in terms of what risks are of concern to the Board. The Board Level Risk image and presentation shows the main categories of risk concerns based on our research of many companies’ enterprise risk assessment results to find "commonalities." These categories are matched to security program mitigation efforts. Using this tool security practitioners are now "talking in the terms of the business," which helps brief senior management on how security fits into the organization's overall risk management program. For more information see the article: Managing Enterprise-Wide Board Risk; also view the Council's Solution Snapshot video: Board Level Risk Categories & Security Program Elements (v.3).
Answer provided by Kathleen Kotwica, PhD, Security Executive Council EVP and Chief Knowledge Strategist and Bob Hayes, Security Executive Council Managing Director
A. I will assume you are asking specifically about security executives given this Q&A's topic area. There are many metrics that can be used (in fact we have identified 375. See the description of our book we published, Measures and Metrics in Corporate Security. However, the issue many security practitioners incur is a) not measuring at all or b) measuring things by simply counting them (e.g., workplace violence incidents or lost laptops), rather than demonstrating the value Security brings to the business. By way of example, convey savings to the company by your program's reduction of workplace violence issues (the cost of managing an event and lost employee time; or cost savings by reducing any potential acts because of your background due diligence program).
Unfortunately, there are no measures and metrics standards in security because factors vary widely; for example, type of industry, size of company, corporate culture, level of regulatory pressure, etc. However, the Security Executive Council created a tool to help security executives understand and communicate what they are doing in terms of what risks are of concern to the Board. The Board Level Risk image and presentation shows the main categories of risk concerns based on our research of many companies’ enterprise risk assessment results to find "commonalities." These categories are matched to security program mitigation efforts. Using this tool security practitioners are now "talking in the terms of the business," which helps brief senior management on how security fits into the organization's overall risk management program. For more information see the article: Managing Enterprise-Wide Board Risk; also view the Council's Solution Snapshot video: Board Level Risk Categories & Security Program Elements (v.3).
Answer provided by Kathleen Kotwica, PhD, Security Executive Council EVP and Chief Knowledge Strategist and Bob Hayes, Security Executive Council Managing Director
