Chapter 3:
Align the business value equation
When Mark became CISO at a growing technology company, he inherited a security program that appeared to be performing well. The monthly reports showed impressive statistics:
Yet, when Mark presented these achievements to the executive team, he was met with polite nods and uncertain looks, all hinting at the same question: what does this mean for us?
Mark realized that while his team was working hard and achieving technical success, they weren't measuring or communicating the things that mattered to business leaders. The security program was generating activity metrics rather than demonstrating business value. Worse still, without meaningful measurements, they couldn't identify which investments were delivering results and which were simply consuming resources.
Leaders, it's time to transform security into a strategic business enabler. This chapter provides a pragmatic approach to aligning security strategy with business outcomes, ensuring every security investment directly supports organizational success.
The key to security alignment is awareness into what the business is actually trying to achieve, not what CISOs think it should achieve. Engage with stakeholders and create a business objective map that connects each priority to specific security implications. For instance:
CEO's priority: Pursue new markets or opportunities
For CISOs, this could mean: Expand into EU market → GDPR compliance program → Data governance and privacy controls.
CFO's priority: Demonstrate ROI on technology investments
For CISOs, this could mean: Quantifiable security value measurement → Security tool consolidation program → Security metrics and cost avoidance tracking.
Is it worth the spend?
Securing internal buy-in might be just as challenging as dealing with external cybersecurity threats. Here's a quick pass/fail method to gauge security investments and determine which ones are financially justified.
How well does this support business objectives?
How much risk does this actually mitigate?
Can we execute this successfully?
Does it aid the best use of limited resources?
Does this enable future capabilities?
Each criterion scored 1-10, weighted by percentage, and assigned a total score between one and ten. For instance, let’s say an organization is considering a $150,000 investment in enterprise-wide MFA deployment. These are the scores based on internal evaluation:
Now we calculate the weighted score using the percentages:
Since 7.75 > 7.0 (the organization threshold), this investment is approved. Likewise, anything over a predetermined threshold can be considered for investment and priority funding can be allocated for highest scores.
Integration with business planning cycles
Security programs achieve maximum impact when aligned with organizational planning cycles as opposed to independent timelines. A quarterly approach ensures security initiatives remain relevant to evolving needs while providing regular opportunities to adjust priorities based on changing market conditions.
focus on strategic planning and alignment. Review business strategy and security implications, conduct executive interviews and business goal discovery, assess and update risk appetite documentation, and develop security strategy alignment validation.
concentrate on operational planning and resource allocation. Prioritize security initiatives and plan resources, develop budgets and business cases, create implementation roadmaps with milestones, and set stakeholder expectations.
launch implementation and early execution. Start high-priority initiatives, implement and communicate quick wins, collect stakeholder feedback and adjust approaches, and establish progress measurement and reporting.
conduct mid-year review and adjustment. Assess business goal progress and security alignment, evaluate initiative performance and correct course, reallocate resources based on changing priorities, and prepare for next cycle planning.
When security initiatives connect directly to business objectives, it unlocks new opportunities, reduces operational costs, and accelerates strategic initiatives, making security investment decisions as compelling as any other business priority.