A Novel Approach for Optimizing Governance, Risk management and Compliance for Enterprise Information security using DEMATEL and FoM

Abstract

Information technology Governance, Risk management and Compliance (IT-GRC) are critical in the contemporary business environment since most of the business processes rely on information technology. However, studies indicate that off-the-shelf IT-GRC products are unsuitable for measuring the effectiveness and efficiency of IT-GRC controls. This article proposes a novel approach of measuring effectiveness and efficiency of IT-GRC controls by using the Decision Making Trial and Evaluation Laboratory (DEMATEL) methodology and arriving at the Figure of Merit (FoM) to find the optimal value of effectiveness and efficiency. The proposed method quantifies the input values by calculating the relative influence and cause of the controls. The efficiency and effectiveness are analysed based on the key metrics such as performance, the strength of security controls, ease of use and cost. The proposed method has been applied to various scenarios with varying controls for evaluation and then the optimal value (Figure of Merit) is found by an iterative method. This method can be extended to any type of IT security control standards and frameworks such as ISO 27001, COBIT 5, ITIL and PCI-DSS.