According to the American Institute of Certified Public Accountants’ (AICPA’s) Top Technology Initiatives survey, the top 10 technology initiatives in 2008 are:

1.       Information security management

2.       Information technology (IT) governance

3.       Business continuity management and disaster recovery

4.       Privacy management

5.       Business process improvement, workflow, and process exception alerts

6.       Identity and access management

Further thinking on our 'think tank' discussions. Keen to keep the conversation going.

It seems to me that there is a current trend to refer to all kinds of enterprise wide control mechanisms as 'governance', or 'governance frameworks'.

If you have any suggestions for our new web site, please comment here.

Purpose:

As security managers and professionals we're increasingly being asked to justify investment on security processes and initiatives. The board / senior management want to understand, is our investment in IS security paying its way?

As yet there are no standard approaches to providing metrics able to answer such questions, yet the pressure is on to respond.

Am interested in what kind of measures you're using or planning to use to measure security performance. Thanks.
Ron Segal