Building Management Commitment through Security Councils

Abstract

One of the most common concerns voiced at the various security conferences and security associations around the country is: “How do we get our management to understand the importance of information security?” Individuals who have been unable to secure the attention or financial commitment from the senior leadership of their respective organizations typically voice these concerns. The question is usually accompanied by frustration as a result of multiple attempts to obtain budget, only to be faced with flat budgets, cuts to the current expenditure levels, or the elimination of separate information security budgets. Each organization has different values, principles, and strategies to move the business forward. This article explores some techniques for building management commitment through the implementation of a successful information security council. Security councils provide an excellent mechanism for establishing buy-in across middle management, and subsequently senior management and the end users of the organization.