Lack of management comprehension

• Management sees 6-36 months as the long view

  • We need strategic planning at the generational level

• Management budgets for IP are incredibly low

  • A good estimate is that 5% of all IT budget should go to information protection for an average company to be reasonably secure against moderate threats
  • For high threats environments, this should be significantly higher.

• Most managers can not manage risk properly

  • Because they lack the necessary knowledge to make prudent risk management decisions

Notes: