CsPI: A New Way to Evaluate Cybersecurity Investments: A Position Paper

This position paper proposes CsPI (Cybersecurity Performance Index) as a new way to evaluate the cyber security investment decisions and measure the progresses and effects of the investments and projects. In a conventional way, cyber security budgets are usually evaluated by the return on investment (ROI), which has some undesirable side effects. Since we don't ask for return on investment for other similar expenses (like IT or capital), why should we use ROI for cybersecurity? Here, we propose to adopt a well-established technique in the project management field called "earned value" to the field of cyber security. Specifically, what we propose is to measure the progress of cybersecurity expenses against a plan. The plan should include protection, detect, respond, recover goals that cybersecurity expenses (people, process, technology) attempt to meet - and this has to take into account business objectives and threat/vulnerabilities. Similar to the "Cost Performance Index" or "Schedule Performance Index" in Earned Value, we can define "Cybersecurity Performance Index" (CsPI). The main idea is to show how well current cybersecurity expenses are performing against a plan. At the end, future research directions are presented.