Numbers: More Executives Say Information Security Can Improve Efficiencies, Drive Business Results

New research from Ernst & Young indicates that companies are having trouble balancing the traditional risk mitigation aspect of information security with its role in improving business performance.

By Katherine Walsh

December 21, 2007 — CSO — Ernst & Young’s 10th annual Global Information Security Survey shows promising evidence that a growing number of organizations believe information security can improve overall corporate performance, as well as protect corporate assets.

However the survey, which canvassed 1,300 senior executives in more than 50 countries, also shows that companies are struggling to strike a balance between performance initiatives and risk mitigation strategies.  

According to the study, “Information security teams must connect with executive management and be involved with the strategic decision-making process from the beginning. This alignment has a positive impact on the bottom line and elevates information security from a technology deployment function to a strategic imperative.”

Key findings:

* Eighty-two percent of respondents reported some level of information security integration with overall organizational risk management, and 29 percent report full integration.

* Sixty-nine percent of respondents said that information security improves IT and operational efficiencies. (In the past, information security has been viewed as a barrier to IT and operational efficiency.)

* Fifty-eight percent of this year’s respondents said privacy and data protection are the second and third most important drivers behind infosec improvements, up from 41 percent in 2006.

* Although 64 percent of respondents ranked compliance as the primary driver of improvements to information security, 45 percent ranked meeting business objectives among the top drivers.

However, information security is still too isolated from executive management and the strategic decision-making process. Thirty-two percent of respondents rarely meet with their board or audit committee. While involvement is increasing, it continues at a slow pace.

More than 50 percent of respondents say that the number one challenge to delivering information security projects is a lack of experienced resources. To that end, 60 percent say they are outsourcing certain aspects of information security.  

Associate Staff Writer Katherine Walsh can be reached at kwalsh@cxo.com.

--

The comment field below does not work. Please send your feedback directly to the author.

Read more about data protection in CSOonline's Data Protection section.

Other stories by Katherine Walsh

• Print