The Challenge:
The Security Profession is under increasing scrutiny and pressure to deliver high value to its constituents with limited resources. And more than ever before, justification is being demanded for the return on investment of dollars put into security. What is more difficult —particularly in this arena —is identifying the benefits of security or safety breaches that don’t occur. How many ounces of prevention are needed to forestall a pound of cure?
Metrus has devoted over 15 years to these questions, and offers custom solutions to security professionals of all types —whether the focus is on IT security, terrorism, pilferage, asset damage, ethics, or physical security. Metrus offers an array of tools to help the security professional:
- Develop a security strategy that is aligned with the overall organizational strategy
- Develop strategic and tactical metrics (scorecards or dashboards) that will help monitor and evaluate the implementation of the security strategy
- Demonstrate the value of security services and initiatives
- Benchmark services and results to best practices in other organizations
- Link security scorecards to performance dashboards of internal supporting units or managed outsourced services (e.g., building security, IT monitoring)
- Monitor supplier performance
- Develop ongoing monitoring and decision making systems to ensure that security processes are operating efficiently and effectively
- Link security performance to rewards
- Comply with government regulations such as Sarbanes-Oxley
Security, like other functional support areas such as HR, IT, Finance and Procurement are being asked to do more with less as competition or budget constraints require organizations to become more efficient and cost effective. Metrus research and experience concludes that most support organizations devote 15-25% of their resources to low or no value-add activities. This is also true of outsourced services in these areas. Surely this doesn’t happen intentionally. It happens most frequently because of:
- weak or poorly communicated strategy
- weak or ineffective measures
- too many lagging measures and not enough leading indicators,
- failure to tightly connect security strategies with department or supplier metrics
- weak links between performance goals and rewards (internally or in external contracts)
- insufficient understanding among employees or contractors of strategic priorities
- lack of involvement or ownership of strategic priorities —that is, lack of self accountability —that leads to compliance rather than excellence
Security Strategy. One size fits all security strategies do not work. Research and experience have shown that security strategies must be tailored and aligned with the overall strategy of the organization in which they operate. Although there are some strategic elements that are common to a particular function or industry, many elements of the strategy will be shaped by the style and preference of CEOs or Boards, the values of the organization, its culture, and its history of security related events. Metrus has specialized in helping functions develop individual strategies that are aligned with the overall mission and strategy of the enterprise. Most importantly, Metrus has a unique strategy mapping process that creates a picture of the security strategy that is helpful in telling the story of how the security organization will be successful, and in showing how it relates to the enterprise and other functional units.
Strategic Metrics. Just like strategies, one sized metrics don’t work. The metrics must be tailored to the unique mission, strategy, and preferences of the executive team. This doesn’t mean that the metrics must be unique —good quality metrics can be used in many organizations, if they fit the strategy. Metrus has a proven process for helping the security team convert their strategy into workable metrics to guide day-to-day execution and to demonstrate to stakeholders, such as senior management, that the function is truly adding value.
Cascade of Metrics to Internal Teams and to External Partners. Metrics sitting in the CSO suite don’t do much to help guide day-to-day employees either within the organization or those working for contractors or partners. Metrus has a well-developed process for helping security units connect their strategic metrics and priorities tightly to supporting groups. This ensures that those groups are maximizing their times and energy on activities that are generating the most value for the organization. Not only does this help create clear goals, but also a way to monitor implementation, and evaluate success. By focusing on leading indicators, most security groups will be able to help correct problems before they get out of hand —essentially no surprises —as advanced warning is a critical requirement in the security industry.
Ongoing Monitoring and Management of Performance Measures. Metrus has helped scores of organizations set up disciplined processes for deploying, monitoring, reviewing, and evaluating performance. Metrus can provide process tools as well as software when needed. Metrus also has strong capabilities in guiding security units in linking rewards to performance, whether this is for internal units or external providers.
Internal Employee Surveys. Some of the larger security organizations need to know how aligned and engaged their employees are in supporting the mission. It is not uncommon to find employees who are simply not engaged at the levels needed to achieve the security goals, or to find engaged employees who are spending far too much time in non-aligned activities. Today, most security organizations cannot afford this waste of resources. Metrus surveys contain comparable performance norms as well as custom items that are unique to your organization. These items help identify the areas in which low or no value activities can be reduced, and ways to increase employee engagement and capabilities.
Organizational Security Surveys. The security team requires the support of everyone in the organization to achieve its goals. Metrus can provide organization surveys, focused on security issues, or can include this topic as one part of an overall employee survey. Understanding how much employees are aware of security issues, and their role in supporting the security team can provide invaluable information about where unsuspected weaknesses may lie.
Supplier or Partner Surveys. Most security organizations today are reliant on a variety of partners or suppliers to provide the specialized services they need. However, these providers may be aligned with your mission to varying degrees. While no supplier will volunteer that they are misaligned with your goals, our experience suggests that many are misaligned in one or more ways. Sometimes it is inadvertent —they don’t really understand your strategy and priorities, so they misallocate their resources (at your expense) in their good but misguided intentions. Or, they are squeezed by cost or competing clients, and have only a “compliance” mentality. In any of these cases, it is important to connect your measurement systems with your suppliers to assure alignment of priorities, and to assess the level of “partnering” that is occurring.
Benchmarking of Security Services. Benchmarking is often misused as a panacea -- “we’re OK relative to the others.” It does have value in helping security professionals understand how well they are doing something relative to other security organizations, or in helping to ferret out best practices, but only when apples to apples comparisons are made. Metrus conducts shared cost studies of security organizations that provide comparison information on a variety of measures that can be reasonably tracked across organizations.
Sarbanes-Oxley. Ethics compliance is a growing area of concern and one in which security professionals are involved more frequently. While many organizations have added hotlines to report security or ethics violations, most of these tools are after-the-fact lagging indicators. Metrus offers a survey tracking system that identifies hot spots before they become catastrophes. This early warning system provides the lead-time needed to investigate risk.
For more information, contact us:- By e-mail or by phone (908) 231-1900