Scope and Planning
Gaining a deep understanding of the organization’s business objectives, culture, current state of cyber security and the desired scope of the engagement.
Cyber Security Organizational Structure and Strategy
What is Cyber Security Organizational Structure and Strategy?
Cyber security organizational structure and strategy provides deep analysis of the human capital and functional roles in cyber security risk management, providing your organization with insight on building a successful team or taking a mature team to the next level. The service leverages the Radford Data and Analytics platform, a product of Aon’s rewards practice, a leading provider of compensation and talent benchmarking data for technology fields.
Cyber Security Organizational Structure and Strategy: The Why and When
-
3.4M
There were 3.4 million unfilled cyber security positions in 2022. [1]
-
43%
43% of organizations cannot find enough qualified cyber security talent. [2]
-
46%
Due to high turnover, 46% of global CISOs have been in their current role for less than two years. [3]
We’re still caught up in a cyber security skills shortage, with many recent analyses concluding that it is getting worse. Organizations are spending more on cyber talent — if they can find it at all. Frustrations with resourcing may be a contributor to persistently high turnover rates in the CISO role. Organizations must take a strategic approach to building an effective team — including how it is structured and which skill sets can help improve their security posture the most.
Cyber security leaders today face constant volatility coming from every direction. Digital acceleration initiatives have expanded attack surfaces, while cyber criminals have ramped up both the volume and the sophistication of their attacks. Technology solutions are one element of an organization’s defense against adversaries, but the human professionals who manage cyber security are even more important.
How Aon Can Help
Cyber security organizational structure and strategy services from Aon provide business leaders with a complete and accurate picture of whether their business’s security risk management capabilities are sufficient to achieve business goals and manage risk to an acceptable level.
Leveraging Aon’s Radford platform, cyber security organizational structure and strategy can also provide clients with a detailed analysis of their compensation structures compared with industry trends and benchmarks. This provides insights that can inform a company’s efforts to attract and retain top talent. We also use the Radford platform to identify key cyber security skills and competencies that are in high demand and provide recommendations on how clients can develop and nurture these skills within their organization.
Cyber security organizational structure and strategy engagements are designed to help you make better decisions in the following areas:
- Is our security program structured and staffed in a manner that it matches our risk appetite?
- Is our security program structured in a manner to optimally enable tactical and strategic business operations?
- Does our security program foster staff development and growth so that we can build and sustain a talent pipeline?
- Is our compensation competitive or is it contributing to our high attrition?
- Is underinvestment in our human capital threatening our business goals?
- Where should we invest in our security program now, next year and the year after?
Our analysis is guided by common industry frameworks such as the National Institute of Standards and Technology (NIST) National Initiative for Cybersecurity Education (NICE), the NIST Cybersecurity Framework (CSF) and the Information Systems Audit and Control Association (ISACA)’s Control Objectives for Information Technologies (COBIT). These frameworks provide best practices and guidelines that can help your organization develop a comprehensive and effective approach to structuring a security program.
Our Cyber Organizational Design Methodology
-
-
Data Collection
Conducting an in-depth review of the organization’s human capital and functional roles for cyber security, as well as the technology stack.
-
Report Development
Producing a detailed Cyber Organizational Design and Strategy report tailored to a client’s unique needs.
-
Review and Reporting
Presenting the report to key stakeholders, with a discussion of actions that should be taken to implement recommendations.
-
Revise and Close
Adding new job descriptions, more guidance on the reorganization of existing teams, and other changes based on client feedback.
