{"id":4400,"date":"2023-03-08T10:44:12","date_gmt":"2023-03-08T14:44:12","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=4400"},"modified":"2023-03-08T10:45:29","modified_gmt":"2023-03-08T14:45:29","slug":"roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/","title":{"rendered":"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance"},"content":{"rendered":"

\"cybersecurity<\/p>\n

Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Doug Barbin of Schellman<\/a> breaks down ROAI and why cost shouldn’t be the only deciding factor when meeting cybersecurity compliance.<\/strong><\/em><\/p>\n

\"ExpertThe cybersecurity industry continues to face new and evolving challenges. With the ongoing adoption of data privacy regulations (e.g., General Data Protection Regulation (GDPR) as well as sector-specific compliance requirements like the Payment Card Industry Data Security Standard (PCI DSS) and the new US Department of Defense Cybersecurity Maturity Model Certification (CMMC), expanding security threats and additional digital footprint complexities, securing and protecting operations and business data has quickly become a top priority for businesses worldwide. With that, companies are under even more pressure to show their customers and business partners that they meet the security and compliance requirements required to do business. To make matters more complicated for compliance and security professionals, recent layoffs, heightened inflation rates, and concerns of recession have put many companies in a position where they must do more with fewer resources– impacting their compliance departments.<\/p>\n

Many organizations turn to cybersecurity firms to audit their operations to uncover security vulnerabilities and help simplify complex compliance objectives. However, the intricacies of varying auditing assessments can make exceptional cybersecurity assessments pricey. Budgeting and cost concerns are top of mind for executives, and rightfully so. With cybersecurity insurance premiums at an all-time high, rising by nearly 30 percent in 2022, many business leaders are feeling pressure to find inexpensive solutions for their auditing assessments. While cost is a crucial factor in any business purchase \u2013 and a top priority for professionals feeling the pressure of current market conditions \u2013 it cannot be the only factor when conducting a security assessment. Instead, Chief Information Security Officers (CISOs) should consider a holistic approach, return on assessment investment (ROAI), when choosing a cybersecurity auditing partner and program.<\/p>\n


Widget not in any sidebars
<\/p>\n

Cybersecurity Compliance: Why Cost Isn’t the Only Factor<\/strong><\/h2>\n
\n

What is ROAI?<\/strong><\/h3>\n

Fundamentally, there is a top-line impact on a compliance program. A company\u2019s adherence to a specific standard may be table stakes for selling to a particular sector like the banks, hospitals, or the federal government. Additionally, third-party audited systems and programs allow companies to use their own cybersecurity as a competitive differentiator. Hyper-scale cloud providers have created multi-million-dollar lines of business by selling to the federal government, which requires the most stringent assessment under the Federal Risk and Authorization Management (FedRAMP) program.<\/p>\n

When ROAI is used to measure the return on a cybersecurity assessments program, it goes beyond dollars and cents. ROAI considers a combination of the expertise, scale, and capabilities an assessment firm possesses to provide a higher level of service with a lower operational cost per report when assessments are performed in a coordinated manner. ROAI also encourages businesses to consider the reputation and resources of a cybersecurity assessment firm to determine whether it can provide the auditing efficiencies and scope of auditing services necessary to not only maintain compliance but to save on costs later downstream. More importantly, the customers and partners relying on compliance reports must be able to trust the reputation and credibility of the assessment firm issuing the reports.<\/p>\n

The Importance of Auditing Efficiency<\/strong><\/h3>\n

When companies think too narrowly about risk assessments, they tend to put too much emphasis on finding a low-cost, well-known provider. While easily recognizable providers \u2013 that spend endlessly on marketing campaigns to showcase their savings \u2013 may seem attractive, more times than not, when put into practice, there are unforeseen \u201ccosts\u201d to actually working with these firms.<\/p>\n

Have you ever shopped for car insurance online? The big ad at the top of your Google search is enticing because it promises to save 15 percent with \u201crates starting as low as…\u201d Unfortunately, once you click through, you realize the only thing you\u2019ll be covered for is your car\u2019s washer fluid. Often, low-cost audit firms implement a tactic known as \u201camendment creep,\u201d where they announce additional add-on fees for different services or enact several rounds of changes to the original, agreed-upon audit contract. Once a contract is signed, a company is, in many ways, at the mercy of its provider; additional licensing audits, price increases, and negotiations all cost an organization time, resources, productivity, and peace of mind.<\/p>\n

That is why an ROAI approach considers the effects of a firm\u2019s auditing efficiency and experience to mitigate contract amendments and business disruptions. Cybersecurity auditing firms that offer 5 percent or less for the number of revisions they can propose to a contract after an agreement is made typically have the confidence, resources, and expertise to consistently deliver high-quality audits without any of the added costs or headaches.<\/p>\n

The Power of Right-Sizing Your Cybersecurity Compliance<\/strong><\/h3>\n

Hand in hand with auditing efficiencies are general administrative efficiencies for IT teams. The beauty (or burden) of cybersecurity operations is that no operation is the same. Businesses need a flexible, scalable auditing program that can mold to their company\u2019s unique needs. Unfortunately, low-cost audit firms or approaches often use predetermined audit templates. These bolt-on solutions templates stimy customization capabilities to provide a tailored experience for a CISO\u2019s team. Additionally, these templated auditing programs are another back door for low-cost cybersecurity firms to tack on additional fees for adjustments needed to remediate auditing needs or for implementing processes to solve inaccurate or imprecise audit results.<\/p>\n

When considering a cybersecurity auditing partner, CISOs must consider a firm\u2019s agility and ability to provide fast, efficient, and customizable compliance programs to adapt to their business\u2019s evolving auditing needs. By assessing cybersecurity needs beyond cost, CISOs will discover the administrative value they can find in their cybersecurity assessment, leading to:<\/p>\n

    \n
  • Less time spent preparing for an audit<\/li>\n
  • Less time spent educating your auditors<\/li>\n
  • Less time spent responding to duplicate requests from customers<\/li>\n
  • Less time spent re-writing reports<\/li>\n<\/ul>\n

    These advantages, in turn, streamline cybersecurity assessment processes, which reduce workloads, eliminate business disruptions and lead to unforeseen cost savings later downstream. Other benefits include improved efficiencies and a better overall relationship with the auditing firm. Put differently, less time spent on draining tasks and adjustments can be the hidden ROAI for businesses when choosing their auditor beyond the initial cost.<\/p>\n

    Conclusion<\/strong><\/h3>\n

    For companies that want to uplevel their cybersecurity compliance programs, cost should be one of many \u2013 rather than the sole \u2013 aspects of an assessment that companies consider. Instead, cost should be a small component of your company\u2019s larger security narrative. By vetting potential risk assessors using ROAI measurements, not only will CISOs find a cybersecurity compliance program with the necessary efficiencies and agility, but they will also find a knowledgeable and trusting auditing partner to help guide their team through their cybersecurity journey.<\/p>\n


    Widget not in any sidebars
    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Doug Barbin of Schellman breaks down ROAI and why cost shouldn’t be the only deciding factor when meeting cybersecurity compliance. The cybersecurity industry continues to face new and evolving challenges. With the ongoing adoption of data […]<\/p>\n","protected":false},"author":542,"featured_media":4401,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,43],"tags":[2238,92,56,2237,2239,2236,1414,86,2235,2234],"acf":[],"yoast_head":"\nROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance<\/title>\n<meta name=\"description\" content=\"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance\" \/>\n<meta property=\"og:description\" content=\"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-08T14:44:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-08T14:45:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Doug Barbin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Doug Barbin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/\",\"name\":\"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg\",\"datePublished\":\"2023-03-08T14:44:12+00:00\",\"dateModified\":\"2023-03-08T14:45:29+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/63d6c3542e86375975dca1caca2d0679\"},\"description\":\"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg\",\"width\":800,\"height\":400,\"caption\":\"cybersecurity compliance\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/63d6c3542e86375975dca1caca2d0679\",\"name\":\"Doug Barbin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8316321351af363c5834677764cd20bc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8316321351af363c5834677764cd20bc?s=96&d=mm&r=g\",\"caption\":\"Doug Barbin\"},\"description\":\"Doug Barbin is Chief Growth Officer and firmwide Managing Principal at Schellman. He is responsible for the strategy, development, growth, and delivery of Schellman\u2019s global services portfolio. Doug has more than 25 years of experience in technology-focused services, having served as a technology product management executive, a mortgage firm CTO\/COO, and a fraud and computer forensic investigations leader.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/dbarbin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance","description":"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/","og_locale":"en_US","og_type":"article","og_title":"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance","og_description":"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2023-03-08T14:44:12+00:00","article_modified_time":"2023-03-08T14:45:29+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg","type":"image\/jpeg"}],"author":"Doug Barbin","twitter_misc":{"Written by":"Doug Barbin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/","name":"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg","datePublished":"2023-03-08T14:44:12+00:00","dateModified":"2023-03-08T14:45:29+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/63d6c3542e86375975dca1caca2d0679"},"description":"Doug Barbin of Schellman breaks down ROAI and why cost shouldn't be the only deciding factor when meeting cybersecurity compliance.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/03\/ROAI-Why-Cost-Isnt-The-Only-Deciding-Factor-for-Cybersecurity-Compliance.jpg","width":800,"height":400,"caption":"cybersecurity compliance"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/roai-why-cost-isnt-the-only-deciding-factor-for-cybersecurity-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"ROAI: Why Cost Isn\u2019t The Only Deciding Factor for Cybersecurity Compliance"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/63d6c3542e86375975dca1caca2d0679","name":"Doug Barbin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8316321351af363c5834677764cd20bc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8316321351af363c5834677764cd20bc?s=96&d=mm&r=g","caption":"Doug Barbin"},"description":"Doug Barbin is Chief Growth Officer and firmwide Managing Principal at Schellman. He is responsible for the strategy, development, growth, and delivery of Schellman\u2019s global services portfolio. Doug has more than 25 years of experience in technology-focused services, having served as a technology product management executive, a mortgage firm CTO\/COO, and a fraud and computer forensic investigations leader.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/dbarbin\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4400"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/542"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=4400"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4400\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/4401"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=4400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=4400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=4400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}