SecOps Outcomes & How to Measure Them

[Sarah Wood]

ServiceNow^® Security Operations (SecOps)

Define and measure success by identifying clear business outcomes and key performance indicators.

Introduction

Many organizations want to transform security operations. However, to translate this strategic objective into tangible business value, you need a clear vision that aligns with your organization’s business goals, identifies targeted business outcomes, and establishes how to measure success. Not only does this help you ensure stakeholder alignment, it also focuses your team’s execution on achieving these agreed outcomes.

Every organization is unique, with its own culture, goals, and challenges, so there is no “one size fits all” vision that you can take off the shelf. However, you can learn from other organizations that have already embarked on a similar transformation journey. In this article, we draw on ServiceNow's experience working with thousands of SecOps customers to provide insights into these journeys, including the most widely targeted business outcomes and the specific key performance indicators (KPIs) SecOps customers use to validate success and drive continuous improvement.

Key SecOps Business Outcomes

The table below summarizes common SecOps business outcomes along with specific objectives that support these outcomes. Think about how each of these outcomes supports your organization’s business goals and create a ranked list. Choose the top outcomes and share these with your stakeholders to get alignment on priorities. Then, evaluate how many of these agreed outcomes you can reasonably address in your initial SecOps rollout, and which ones need to be delivered in future phases. Use this to create a SecOps roadmap that is aligned with your strategic goals, and, once again, share this with your stakeholders to get their agreement and support. You can achieve all the business outcomes below over time. However, by prioritizing which ones to target first, you accelerate time to value and avoid casting your net too wide.

SecOps Business Outcomes	SecOps Business Objectives
Optimize and orchestrate enterprise security operations	Increase security Tier 1 effectiveness Reduce security incident resolution effort Accelerate security incident response Accelerate major security incident response
Systematically harden the digital attack surface	Reduce effort for vulnerability management Increase coverage of critical vulnerabilities Accelerate response to critical vulnerabilities Increase coverage of non-critical vulnerabilities Accelerate response to non-critical vulnerabilities
Respond with agility to evolving cyber threats	Increase in timeliness, completeness, visibility of security posture across all stakeholders Reduction in absolute and/or severity-weighted rate of new incidents
Ensure frictionless collaboration between Security, Risk and IT	Reduce IT effort to remediate vulnerabilities Streamline vulnerability exception management Decommission legacy SecOps systems spend

SecOps Key Performance Indicators

Here are examples of the KPIs that ServiceNow SecOps customers can use to measure success. They do not map one-to-one with the business objectives we’ve just discussed — one KPI may be applicable to multiple business outcomes. Note that these KPIs should be tailored to your organization. Select the KPIs that support your chosen business outcomes, tailor them, and identify how you are going to measure them. It’s also important to establish a baseline for your selected KPIs. For instance, if your KPI target is a 50% reduction in mean time to remediate vulnerabilities, you need to know your current mean time to remediate vulnerabilities so you can measure your progress. Once again, make sure you share your KPI targets and timelines with your stakeholders and get their buy-in. This will allow you to set clear expectations on what success looks like and to demonstrate that success once you have achieved these targets.

	SecOps Key Performance Indicators
1	50% reduction in mean time to close security incident
2	50% reduction in mean time to remediate vulnerability
3	30% reduction in mean time to close major security incident
4	10% reduction in number of unaddressed critical vulnerabilities
5	15% reduction in number of unaddressed non-critical vulnerabilities
6	30% reduction in security incidents handled by Tier 2+
7	Reduction in time to remediate security incidents: Tier 1: 14%; Tier 2: 7%
8	50% improvement in efficiency of vulnerability management FTEs
9	50% improvement in efficiency of IT vulnerability FTEs
10	25% increase in number of vulnerability exceptions
11	Avoid all future costs associated with legacy systems

Visit ServiceNow Impact and Now Create for additional resources and to learn more about achieving value with SecOps.