Purpose:
As security managers and professionals we're increasingly being asked to justify investment on security processes and initiatives. The board / senior management want to understand, is our investment in IS security paying its way?
As yet there are no standard approaches to providing metrics able to answer such questions, yet the pressure is on to respond.
