Organizations have a critical need for skilled cybersecurity resources as the cyberthreat landscape becomes more complex. This has put a strain on many security teams who must continue to meet demand for an increasing number of security services. To deliver services well, we first need to determine what are the organization’s key security requirements. While benchmarks can be useful for quick peer-to-peer comparisons to determine if we are within the average range, they tend to make all security programs seem the same. This can lead to misguided investments in security services and personnel that might be better used elsewhere.

Security teams will be most successful when organizations take a personalized approach to security, considering what must be done to lower risk and operate more efficiently and effectively.

Logan Rohde

Senior Research Analyst, Security

Info-Tech Research Group

Isabelle Hertanto

Principal Research Director, Security

Info-Tech Research Group

• IT and Security leaders across all industries must determine what and how many resources are needed to support the information security program.
• Estimating current usage, the right allocations, and future demand for security resources can be a difficult and time-consuming exercise.

• Needing to provide a benchmark to justify increasing headcount.
• Absence of formally defined security service offerings and service owners.
• Lack of skills needed to provide necessary security services.

• Info-Tech’s approach to resource planning focuses less on benchmarks and more on estimating actual demand for security services to ensure that there are enough resources to deliver them.
• A well-designed security services portfolio is the first step toward determining resourcing needs.
• When allocating resources, plan for both mandatory and discretionary demand to position yourself for greatest success.

1 Gather Requirements and Define Roles

1.2 Choose Security Service Offerings

2.1 Assess Demand

3.1 Review Demand Summary

3.2 Develop an Action Plan

Security requirements

Security service portfolio

Service demand estimates

Service hour estimates

Three-year resourcing plan

Security programs should be designed to address unique business needs.

A service-aligned security resourcing strategy will put organizations in the best position to respond to current and future service demands and address business needs as they evolve over time.

Watch out for role creep.

It may be tempting to assign tasks to the people who already know how to do them, but we should consider which role is most appropriate for each task. If all services are assigned to one or two people, we’ll quickly use up all their time.

Time estimates will improve with practice.

It may be difficult to estimate exactly how long it takes to carry out each service at first. But making the effort to time your activities each quarter will help you to improve the accuracy of your estimates incrementally.

Start recruiting well in advance of need.

Security talent can be difficult to come by, so make sure to begin your search for a new hire three to six months before your demand estimates indicate the need will arise.

People and skills are both important.

As the services in your portfolio mature and become more complex, remember to consider the skills you will need to be able to provide that service. Make sure to account for this need in your resource planning and keep in mind that we can only expect so much from one role. Therefore, hiring may be necessary to keep up with the diverse skills your services may require.

Make sure your portfolio reflects reality.

There’s nothing wrong with planning for future state, but we should avoid using the portfolio as a list of goals.

IT Benefits

Business Benefits

• Allocate resources more effectively across your security and risk teams.
• Improve employee engagement and satisfaction with clearly defined job roles, responsibilities, and service levels.
• Raise the profile of your security team by aligning security service offerings with the demands of the business.

• Ensure that people, financial, knowledge, and technology resources are appropriately allocated and leveraged across the organization.
• Improve your organization’s ability to satisfy compliance obligations and reduce information security risk.
• Increase customer and business stakeholder satisfaction through reliable service delivery.

Metric

Expected Improvement

Level of business satisfaction with IT security

You can expect to see a 20% improvement in your IT Security Business Satisfaction Diagnostic.

Reports on key performance indicators and service level objectives

Expect to see a 40% improvement in security service-related key performance indicators and service level objectives.

Employee engagement scores

You can expect to see approximately a 10% improvement in employee engagement scores.

Changes in rates of voluntary turnover

Anticipating demand and planning resources accordingly will help lower employee turnover rates due to burnout or stress leave by as much as 10%.

DIY Toolkit

Guided Implementation

Workshop

Consulting

Call #1: Scope requirements, objectives, and your specific drivers.

Call #2: Discuss roles and duties.

Call #3: Build service portfolio and assign ownership.

Call #4: Estimate required service hours.

Call #5: Review service demand and plan for future state.

Define Roles and Select Services

Estimate Current and Future Demand

Identify Required Skills

Future Planning

Next Steps and
Wrap-Up (offsite)

1.1 Assess Security Needs and Business Pressures.

1.2 Define Security Job Roles.

1.3 Define Security Services and Assign Ownership.

2.1 Estimate Current and Future Demand.

2.2 Review Demand Summary.

2.3 Allocate Resources Where They Are Needed the Most.

3.1 Identify Skills Needed Skills for Planned Initiatives.

3.2 Prioritize Your Skill Requirements.

3.3 Assign Work Roles to the Needs of Your Target Environment.

3.4 Discuss the NICE Cybersecurity Workforce Framework.

3.5 Develop Technical Skill Requirements for Current and Future Work Roles.

4.1 Continue Developing Technical Skill Requirements for Current and Future Work Roles.

4.2 Conduct Current Workforce Skills Assessment.

4.3 Develop a Plan to Acquire Skills.

4.4 Discuss Training and Certification Opportunities for Staff.

4.5 Discuss Next Steps for Closing the Skills Gap.

4.6 Debrief.

5.1 Complete In-Progress Deliverables From Previous Four Days.

5.2 Set Up Review Time for Workshop Deliverables and to Discuss Next steps.

1. FTE-Hours Calculation
2. Security Roles Definition
3. Security Services Portfolio

1. Demand Estimates
2. Resourcing Plan

1. Skills Gap Prioritization Tool
2. Technical Skills Tool

1. Technical Skills Tool
2. Current Workforce Skills Assessment
3. Skills Development Plan

1.1 Gather Requirements and Define Roles

1.2 Choose Security Service Offerings

2.1 Assess Demand

3.1 Determine Resourcing Status

• List of key business requirements and industry pressures

• Prioritized list of security program requirements

• Whiteboard
• Sticky notes

• CISO
• Core Security Team
• Business Representative (optional)

• Full-time hours worked per week Weeks worked per year Existing job descriptions/roles

• Calculated full-time equivalents (FTE) Defined security roles

• Security Resources Planning Workbook

• CISO
• Core Security Team