Skip to main content
Joe C. Hawley · ResearchCybersecurity governance, risk, and value

About

Research on how security organizations measure, prove, and communicate the value they deliver.

Research is the product. This platform documents research in progress, not just final outputs. Working theories, raw observations, literature frameworks, and the reasoning behind decisions are published as they develop.

Research Focus

The current research, Project 002, asks: How can security organizations consistently measure and communicate the realized business value they deliver? The study is role-neutral: it does not assume or test any specific security role.

Research Questions

  1. RQ1What does published evidence say makes a cybersecurity value claim credible to business executives?
  2. RQ2What lightweight, repeatable mechanism can capture and communicate realized value without adding governance overhead?
  3. RQ3What capabilities do validation and communication of security value require, based on published evidence?

Earlier research examined the BISO as a governance intermediary (paused).

About the Researcher

Joe C. Hawley is a cybersecurity director and Business Information Security Partner with experience spanning security governance, risk management, and security-business integration across enterprise environments.

He is completing a Master of Science in Cybersecurity at Georgia Tech. His graduate research develops and evaluates a framework for measuring and communicating the realized business value of cybersecurity, using Design Science Research.

This site is where that research lives publicly. It documents the work as it happens, not just when it is done.

Elsewhere

For research inquiries or collaboration, reach out via LinkedIn.