Using IT Benchmarking Principles to Design an Information Security Benchmark Model.
Leonie McManus, Jan H. P. Eloff · 2006
This paper examines the current state of IT benchmarking and the problem of using conventional IT benchmarking models to benchmark Information Security environments. A framework is presented as a starting point for further development to obtain a fully-fledged, operational Information Security benchmark model. This model will determine what money companies are spending on Information Security and whether there is a correlation between the level of Information Security, cost and effectiveness. Once this model has been fully developed and populated, companies will be able to use it as a benchmark tool to determine the cost efficiency of their information security environments. One of the key outputs of this model will be a list of possible areas or actions that companies should focus on in order to improve Information Security efficiencies.