"Obtaining support and funding from senior management - while planning an awareness initiative" is a new free document from ENISA (the European Network and Information Security Agency - an official European Union body that describes itself as a centre of network and information security expertise for the EU Member States and Institutions) that extends the coverage of a previous product, "The new users' guide: How to raise information security awareness".
The new guide is aimed at helping readers scope, plan and justify their security awareness programs to management. Starting with an explanation of the need for, and value of, information security awareness (parts of which I contributed), it describes techniques to obtain management support and funding. It delves into ROI or ROSI (Return on [Security] Investment) using standard financial investment appraisal techniques to develop the business case for information security awareness, pointing out the difficulties of defining the benefits part of cost-benefit analysis for risk avoidance initiatives. It offers worthwhile tips on communicating security needs to management, especially by aligning security with other strategic objectives. This gets right to the heart of a key issue: without senior management's understanding and proactive support, information security initiatives are severely constrained if not doomed from the start. Whereas IT security can be handled primarily within IT Department, the scope of information security extends across the entire enterprise and necessarily involves a wide tranche of managers. Raising management's security awareness is therefore an important starting point.
Another good reason for developing business cases for investments in information security is that they naturally suggest a suite of metrics that can be used not only to assess the value of the investment but also to drive further security improvements. I heartily recommend taking a good look at ISACA's ValIT framework for more on this.
A fine international team of acknowledged awareness experts collaborated to produce the document using email, telephone conferences and Google Docs (which proved ideal for me, being based on the far side of the globe from Europe!). Credit is due to the editors from ENISA who kept us all in line and worked wonders on the formatting and presentation. Nice job!
