Assessment for Enterprise Security Decision Making

Assessment is an integral part of a chief information security officer’s (CISO) daily work. Continuously, the CISO must make security policy decisions, either introducing new policies or technologies in the organisation, or modifying existing policies. Assessment in this environment must inherently go beyond assessment of the policy’s security properties alone. It must include considerations about the impact of the security policy on employee productivity, the cost associated with it and the impact on business processes. Assessment therefore is less about precision than it is about comprehensiveness.