Maximizing the Return on Investment on Information Security Programs: Program Governance and Metrics

Abstract This article provides a discussion of the way organizations currently seek to effectively evaluate their existing information security initiatives and to build realistic business cases to increase executive awareness of risk and regulatory compliance, and, therefore, to secure budgets for new expenditures on internal controls.