Information Security Blog

Metrics – Measuring IT value

Question since start of mankind:
- How do I measure IT and Security Value?

Statistic:
- More than 80% of companies do not track IT metrics; higher percentage for IT Security departments

Importance:
- Metrics drive your business revenue and support your business decisions

Why is it so difficult to measure ROI on Information Technology and Information Security?
- Complex departmental integration to IT systems
- Difficult to benchmark:
 absence of knowledge
 absence of tools
 absence of resources
- Out of the box software - difficult and time consuming to configure
- Who develops metrics? Not everyone on the same page…
 IT (too busy)
 CFO/Finance
 CEO/Executive
 Outsourced company
- Numbers can always be challenged by other groups or methods
- Difficulty combining metrics to develop the bigger picture�
- Do you have enough metrics? When do you stop? (Over-sample – Overkill)
- Number of communication challenges when delivering to various corporate levels and groups
- Quantitative vs. Qualitative results?
- Not only do you need to �walk the talk� but you must also �talk the walk�!

Benefits when you talk metrics:
- Achieve Business alignment and metrics guide your business decisions
- Assist Decision makers in doing their job better
- Convince of value and prove Return Of Investment to executives
- Rank higher in the company�s exec�s eyes
- Detrimental change in corporate landscape
- Cost savings
- Scalability
- Revenue driven goals
- Success should always be measured in IT, Business and Financial terms. No single metric provider can take credit of a success