Gaining Support for Security Programs
Robert J. Emery · 2019
An inevitable finding of any review of a security program is the need for “improved communications.” Successful security programs function largely in the realm of prevention, so on a good day, “nothing happens.” Therefore the challenge for security programs is to be able to articulate what resources are needed to “make nothing happen.” In order to do this, data is needed to justify assertions and claims. “Systemic measures” consist of data that describes the ultimate outcome of a program. For example, a security program might be measured by the number of reported thefts or assaults recording in a given time frame. The other main category of measures is “organic measures,” which are data describing efforts undertaken prior to a systemic outcome. The systemic measures should drive the organic measures, such that preventive activities are focused on reducing or eliminating negative systemic outcomes.