You Are What You Report: Marketing the Value of Information Security

Regular and effective communication between information security programs and executive leadership is a critical success factor for any information security program. However, information security practitioners in higher education often face a challenge when telling their story and connecting their important contributions to their institution’s mission and objectives. This challenge is often based on several factors:

• An information security program's successes in areas like cybersecurity and risk management are rarely evident and are often difficult to understand.
• Executive leaders (e.g., boards, cabinets, presidents, chancellors) have a broad purview, and information security reporting must be timely, accurate, and, often most challenging, brief.
• Information security programs generally express their contributions in terms of metrics based on security operations activities, process maturity modeling, or compliance tracking. While these are all valid and valuable metrics, these measurements rarely connect directly with issues that are of the most importance to executive leadership.

This short post explores value-based information security reporting, which represents a focus on establishing narratives of information security excellence in relation to three key themes:

• Shared security successes
• Security enablement
• Executive leadership priorities and themes

Each report item is covered briefly below. A report sketch is also provided to help stimulate some ideas on how you can frame your successes in a new light, whether it's in meetings with leadership or with "elevator speech" opportunities.

Shared Security Successes

Information security successes are almost never solitary endeavors but involve important partnerships. While it may be tempting to highlight the contributions of the information security team (especially if perhaps the lion's share of the work has fallen to your team), it is often more important to ensure that leadership sees these contributions as collective wins. This accomplishes several important objectives:

• It stresses the connectivity of information security in protecting the core-to-mission objectives of academic, research, and administrative areas.
• It demonstrates the information security team's ability to foster the values of collaboration and collegiality that are integral to higher education culture and hallmarks of successful projects and endeavors.
• It encourages continued engagement from campus partners, as they have seen how security collaboration offers broader recognition of their own efforts to help protect institutional data and reputation.

Security Enablement

Information security is often viewed through a lens of what is prevented. However, it is equally important to also be able to highlight how the contributions of information security programs build trust and resiliency and support informed selections of risks. This type of reporting necessitates taking in the big picture of how information security's risk management activities help decision makers exploit greater efficiencies and expand information service functions while also maintaining a desirable risk balance.

Here are a few important considerations when looking at how you can reflect these value contributions:

• Success narratives in this area demonstrate a focus on seeking a pragmatic balance between risks and opportunities. To that end, it is very important that equivalent time and effort is spent understanding and relating the value proposition of an information need as well as its risk implications.
• The partners you work with on these initiatives are often your best source for perspective in this area. Their insight and external vantage point are invaluable to better see how your own efforts support their endeavors, needs, and decision-making ability. Periodically reaching out to collect and discuss the goals and strategic plans of institutional units can be a great step to look for areas where your team can help safeguard the success of important endeavors.
• It is requisite that your risk management methodology has developed sufficient formalism to ensure that risks are consistently analyzed, ranked, and communicated in a common manner. (Some great ideas and tips on furthering your risk management methods can be found in the EDUCAUSE Information Security Guide.)

Executive Leadership Priorities and Themes

It may sound like a no-brainer that you need to pay attention to leadership priorities and themes. However, when was the last time you really listened to and reflected on the objectives that your leadership set forth in meetings, public speeches, or strategic planning materials? Quite often, executive leadership will continually reinforce and reiterate key concepts, values, and institutional objectives to campus populations. When listening to your leadership communicate high-level objectives, it is especially fruitful to develop the habit of immediately considering how information security can contribute to success in these areas. In this day and age, every organizational objective invariably has some information dependency. While student retention objectives on the surface may not sound like information security issues, once you begin to tease apart how these objectives are pursued, information protection and assurance needs become very clear.

When you listen carefully and reflect key organizational goals within your own information security plans, you demonstrate that you are able to connect your work at the highest level of your institution's goals and mission. This is especially valuable to executive leadership, as it reaffirms trust that your program is connects with, aligns with, and supports these high-level objectives. Additionally, often by listening to and adopting the communicative themes used by leadership to explain information security contributions, you help your leadership see the relevance of information security efforts to their own strategic priorities.

Value-Based Report Sketch

The following "report sketch" is intended to generate some ideas on how you might frame your team's successes in a manner that highlights the three key themes listed above. Thinking through some of these report questions may help you consider new ways to relate your successes in a way that truly connects with leadership.

Some general report tips:

• Keep it short
• Keep it simple
• Avoid jargon and acronyms
• Measure graphics or charts by the quality of the questions they bring forward

Sample Quarterly Information Security Report

James Webb is the chief information security officer at Appalachian State University.