The Cyber Risk Handbook

Chapter 5 Cyber Strategic Performance Management

McKinsey & Company James M. Kaplan, Partner, McKinsey & Company, New York, USA Jim Boehm, Consultant, McKinsey & Company, Washington, USA

If you don’t measure it, you can’t manage it,” said George, the chief strategy officer, to a nodding CEO Tom.

Cybersecurity performance can be managed, but only if measured.

The ability to measure performance has always been at the heart of effective management, underlying decisions about how to allocate resources, which practices to employ and whom to reward. Much more so than in the past, this is an age of granular and systematic performance management. Senior executives are exploiting massive amounts of data to understand which products generate profits, which salespeople sell effectively, and which operational teams execute with the highest degree of efficiency.

Sadly, in many respects, cybersecurity is an outlier to this trend. Measuring cybersecurity performance is hard. Traditional business performance metrics like revenue or cost are not really relevant. Analogues to market risk and credit risk metrics like value at risk do not exist for cybersecurity. And measuring cybersecurity incidents might lead you to believe you are doing a good job protecting the organization—when in fact you are doing such a bad job monitoring the environment you cannot even detect ongoing attacks.

The difficulty in measuring cybersecurity performance does not make it any less important. The dynamic nature ...