Skip to main content
Joe C. HawleyCybersecurity governance, risk, and value
Cybersecurity ValueActive

Measuring and Communicating the Realized Business Value of Cybersecurity

Current Stage: Lit. Review

Research Questions

  1. RQ1What does published evidence say makes a cybersecurity value claim credible to business executives?
  2. RQ2What lightweight, repeatable mechanism can capture and communicate realized value without adding governance overhead?
  3. RQ3What capabilities do validation and communication of security value require, based on published evidence?

Working Thesis (v0)

A working thesis has not yet been formulated. Design propositions P1-P3 guide the work and will be tested before a thesis is stated.

This thesis evolves as research progresses.

Project 002 examines how security organizations measure and communicate the realized business value they deliver. It follows a Design Science Research approach: the output is a framework that is built, demonstrated on synthetic cases, and evaluated without participants through requirements testing, comparative analysis against existing frameworks, and a test against public material. No data is collected from people. The study is role-neutral: it does not assume or test any specific security role.

Design propositions

These are argued from literature and public evidence, not tested with participants. RQ3 is exploratory and has no expected answer.

  • P1: Value is "realized" only when the beneficiary confirms it. Self-reported value from the security team is not credible on its own.
  • P2: The binding constraint is translation and validation with business owners, not measurement technique.
  • P3: Realized value reporting (backward-looking, beneficiary-validated) complements protection-level governance such as outcome-driven metrics and protection-level agreements (forward-looking, executive-agreed). It does not duplicate it.

Artifacts

View all →

Framework

0 of 1 published
Realized Value Frameworkv0.6

A framework for capturing, validating, and communicating the realized business value of security work.

Draft v0.6. Content will be published after evaluation.

Analysis

0 of 1 published
Synthetic Value Recordsv0.1

Eight generic Value Records used to demonstrate and test the framework.

Used internally to demonstrate and test the framework. Not published.