Creating a monthly Information Security Scorecard for CIO and CFO

Executives are increasingly interested in the state of information security for their organization. The media and press are frequently reporting new methods of technology attack and how another organization has become a victim. Regulators and auditors including PCI, GLBA, SOX, HIPAA, etc. are demanding more executive time and attention. Routinely communicating in a clear and concise manner with the CIO and CFO is necessary for today's information security leader. Determining what should be communicated and in what format can be a challenge. This paper will provide readers an approach for creating a Security Scorecard to routinely update the CFO and CIO regarding information security compliance, investment, and risk metrics.