Measuring and Communicating the Realized Business Value of Cybersecurity
↑ Current
Current Stage: Concept
Research Questions
- RQ1What does published evidence say makes a cybersecurity value claim credible to business executives?
- RQ2What lightweight, repeatable mechanism can capture and communicate realized value without adding governance overhead?
- RQ3What capabilities do validation and communication of security value require, based on published evidence?
Working Thesis (v0)
A working thesis has not yet been formulated. It will be developed during the literature review.
This thesis evolves as research progresses.
Project 002 examines how security organizations measure and communicate the realized business value they deliver. It follows a Design Science Research approach: the output is a framework that is built, demonstrated on synthetic cases, and evaluated without participants through requirements testing, comparative analysis against existing frameworks, and a test against public material. No data is collected from people. The study is role-neutral: it does not assume or test any specific security role. A working thesis has not yet been formulated.
Design propositions
These are argued from literature and public evidence, not tested with participants. RQ3 is exploratory and has no expected answer.
- P1: Value is "realized" only when the beneficiary confirms it. Self-reported value from the security team is not credible on its own.
- P2: The binding constraint is translation and validation with business owners, not measurement technique.
Artifacts
View all →No artifacts yet.