Using IT Benchmarking Principles to Design an Information Security Benchmark Model

This paper examines the current state of IT benchmarking and the problem of using conventional IT benchmarking models to benchmark Information Security environments. A framework is presented as a starting point for further development to obtain a fully-fledged, operational Information Security benchmark model. This model will determine what money companies are spending on Information Security and whether there is a correlation between the level of Information Security, cost and effectiveness. Once this model has been fully developed and populated, companies will be able to use it as a benchmark tool to determine the cost efficiency of their information security environments. One of the key outputs of this model will be a list of possible areas or actions that companies should focus on in order to improve Information Security efficiencies.