The New Performance-Based Security Program

Authored by The Sage Group

The Professional Services Group (PSG) of Aronson Security Group asked us to comment on four questions related to metrics. Since creating, measuring and accelerating value is our focus, we were happy to oblige. Here were the four questions:

* How do you determine what to formally measure? * How do you collect, understand and report on those metrics? * What value does security get from investing in metrics? * What value does the organization get from investing in metrics?
What is Performance-Based security?
Measuring security performance means assessing business and security results to: (1) determine how effective the strategies and operations are and (2) make changes to address shortfalls and other problems.
There are different methods and criteria for measuring performance. However, the common strand through each is the ability to measure the results generated by core business processes, using specific metrics. For each process, there are many possible metrics.
Why should Security Organization’s Measure? * Improvement: Understand your strengths and your weaknesses. Show continuous improvement over time. * Planning and forecasting: Performance metrics creates a progress trend line allowing organizations to not only be clear on their current performance position but also forecast their future condition based on the data * Technology Lifecycle Management: Performance metrics are non-existent for the up-time metrics of the hardware and software that security uses. But this ‘viability index’ can measure service costs, availability costs, levels of risk incurred with downtime, and the lifecycle of the total solution. * Security as ‘friction’ or ‘lubricant’ to company value: When Security interacts with core business processes, is it an obstacle to company performance or a critical value driver? These intersections are more common than you think. Find them and measure them and reap the rewards. * Competition: When organizations benchmark their performance against their competition or even similar companies in a different market space they can identify practices that can improve their performance over time * Reward: By knowing the organization, the department and individual employees that have performed in achieving their outcomes, leaders can determine budget and compensation alignment accordingly * Regulatory and standards compliance: A baseline metric and a benchmark assist in forecasting compliance capacity and performance.
How do you start?
Performance Management begins with defining your objectives, the Critical Success Factors (CSFs), and the metrics by which you will measure performance.
Security, as an organization, may have inherited a company system by which this is expressed. If so, then the data you will eventually collect will be expressed through that form or expression.
Regardless, you must understand the objectives of your leadership team and how performance is best expressed, then arrive at your own that aligns with those objectives.
For each objective you arrive at, you must determine the actions that will lead to a successful outcome. These are your CSFs. Then you add a performance metric that defines the success of a CSF and a target for individual and organizational achievement.
The following represents a simplification and example of that effort: Objective | Critical Success Factors | Performance Metric and Targets | Reduce Cost in our processes | * Assess Processes for Velocity, Quality, and Outcomes looking to reduce steps, time, and cost * Review Technology (Tools) deployed * Review and assess supply chain for outside services and products | * Improve Time to Value/Action by 10% * Increase Quality of Service by 25% * Reduce cost of bidding process and vendor management by 50% | Improve Knowledge Sharing | * Identify key processes and reports * Identify critical ‘consumers’ of each * Identify portal technology that leverages authors, reviewers and consumers | * 100% Awareness of and ability to access documents, reports and data by critical consumers * 100% Compliance with key processes improves by 50% |
Acquiring the baseline data for performance measurement is critical. In some cases the data exists but it is difficult to access because it resides in another department, in a database that does not have a clear or straightforward means to report on it, or it is with an external party. However, without data, future measurement cannot take place. A good security process consultant will walk a process through its steps measuring the velocity and documenting the behavior of the people and their tools.
Sometimes you need to measure subjective and objective data. For example, how would you measure ‘Customer Satisfaction’; you might use an objective survey form to acquire subjective data.
You must also consider the reliability of the data you are collecting. Consider future measurements you will be taking over time and ensure you are getting reliable, accessible, and accurate data.
Finally each metric has a target. The target is a science and an art. Targets must be achievable but also inspire exceptional performance. In a period of initial change, consider setting targets that are readily achievable to help your people adjust to the new conditions. Over time, begin creating competitive benchmarks from industry data that allow you to claim a clear leadership position.
Security as a process, through its people, and through the technology it uses generates data. Determining how to translate data into information and then elevate it to security business intelligence will be critical to managing cost effective security programs that allow for transformative innovation. Product manufacturers need to make it easier to exploit the data that is generated by their technology devices and software. Integrators need to know the business better to be able to assist in workflow and technology use patterns. And security professionals must become performance driven for the sake of their profession, the companies they represent and their strategic place at the table in the C-Suite.