Business and Security Executives Views of Information Security Investment Drivers: Results from a Delphi Study

A Delphi study used two expert panels of 24 CEOs and 22 security executives to identify and rank factors that motivated organizations to invest in information security. Both panels agreed that legal and regulatory compliances were the most important drivers. However, their different perspectives about other drivers, particularly the extent to which information security provided a competitive advantage, implied that business executives were more likely than security executives to view information security as a cost center rather than a business enabler, thus the author suggested a greater need for technology executives to help business executives better understand how information security investments could provide competitive advantage. In general, the study highlighted the need for more dialogue and information sharing between security executives, who are responsible for designing the organization’s security infrastructure, and business executives who must allocate the funds to support that infrastructure.