Management Buy-In - Part 1: Why You Need It

Every information security framework and “best practice” guide to cyber security states that you need “management buy-in”, but why is it important and what does it look like?

Management buy-in can be referred to by terms such as “top management support” or described as a need to allocate information security responsibilities to a senior member of management, such as a Chief Information Security Officer. Whichever way it is stated, the requirement means that those in the organisation that have strategic visibility over the entire organisation also have a say in the information security priorities.

The mostly important reason for management buy-in is to make sure the security program meets the business needs. Organisational goals can include such things as high availability of services, maintaining reputation, being agile or ensuring confidentiality. The information security program must work towards these business needs to provide value and justify its existence.

Secondly, organisational risks, including information security risks, are the responsibility of senior management. A good management team will need to understand the risks they are accepting so they are comfortable with their possible level of exposure. If management do no have buy-in, it is quite possible they do not understand their risks are so are “flying blind”.

At a more pragmatic level, resources are allocated by senior management. If a security program is not provided with sufficient staff, time and money then it will not be able to carry out its objectives and provide the level of protect required.

Now that we have established that management buy-in is important, how to do you tell how your organisation is faring? The following table shows some ways to identify if you currently have management buy-in. If you can relate to several of the statements in the left column, then you most likely do not have a sufficient level of management buy-in.