By Cyber Era NG Special Correspondent

Creator of the first Security Programme Management (SPM) platform built by, for, and with chief information security officers (CISOs), Blue Lava has released findings from its joint study with Aimpoint Group titled Security Program Management: Priorities and Strategies which explores how security leaders measure and manage security programmes and communicate priorities to executives and boards. The report offers valuable insights into the broader understanding of security programme management practices, as well as advanced capabilities that some organizations are deploying, including automating operational tasks to free up time for security teams to work on strategic activities.

According to the new study, security leaders — despite spending 41-80 hours per meeting preparing to meet with management — continue to lack tools to automate portions of this activity which would free up hundreds of hours of time annually for CISOs and senior security experts. Today, security leaders have an unprecedented degree of visibility and influence in boardrooms – at the price of frequent scrutiny. A large majority of security leaders now meet with their board of directors quarterly (37.3%) or monthly (39.6%) to communicate security priorities and investment needs.

“The study confirms that while frequent interaction between security leaders and boards of directors has become the norm, CISOs struggle to communicate their risks, progress, needs, and priorities to top executives and boards of directors,” said 3x CISO and Co-Founder, Blue Lava, Demetrios Lazarikos (Laz),. “We’re seeing more and more accountability at the Board Level for Cybersecurity initiatives — the recent SEC Guidelines on Cybersecurity is a key initiative that supports this effort.”

The report includes detailed information about how often security leaders assess the maturity and effectiveness of their security programs. Key takeaways from the study include:

Organizations that today assess the maturity and effectiveness of their security programs only annually, or to meet the needs of audits and special events, should move to more frequent or even continuous updates.

Security leaders agree that there are many areas of security program management where improvements would strengthen security and enhance the effectiveness of security teams.

Organizations can obtain the most value from upgrading their ability to collect security data efficiently, to use peer data for benchmarking program performance, to define and implement a security roadmap, to identify, prioritize, and mitigate risks, and to align their security program with business objectives.

This survey was developed by Blue Lava and AimPoint Group. It was conducted in December 2021 in the United States, reaching 268 CISOs, CIOs, and senior security and risk managers, within organizations of 500 or more employees. Responses about these and other standards would differ in other parts of the world.