Page 391 - CyberSecurityEssentialsEnglish

Relying on lagging indicators alone makes an organization learn only after harm. Relying on
leading indicators alone may give a false sense of compliance: forms and training may be
complete while the quality of review stays weak. The indicators should therefore be linked:

did errors fall after the training? Did decision time fall after the approval route was
simplified? Did scaling accelerate without a rise in incidents?

Turning an indicator into a target detached from its purpose must be avoided. If teams are
rewarded for the number of approved use cases, projects may be fragmented or weak cases
approved. And if the target is zero incidents, reporting may stop. A good indicator helps in

asking a question and improving a decision; it does not become a number that flatters reality.

Total Cost of Ownership
A monthly price is not the total cost of ownership. The cost includes data preparation,
integration, security, training, human review, support, retesting after updates, incident

handling, and exit from the vendor. It also includes opportunity cost: time invested in a
project that delivers no value, or trust lost through poor outputs. The new scenario must be
compared with the current process, not with an abstract marketing promise.
A Practical Roadmap

FIGURE 8-10: STAGES OF RESPONSIBLE INSTITUTIONAL ADOPTION
What to notice: Moving from discovering value to building foundations, a controlled pilot,
graduated scaling, and improvement, with the option to pause or step back at every stage.

Source: Prepared by the author.

◆ Stages of the roadmap
• Discover value: a map of tasks, uses, and first risks.
• Build foundations: a short policy, a register, roles, and basic training.
• Run a controlled pilot: one or two cases with indicators and a test set.
• Scale gradually: templates, approval, monitoring, and integration.
• Improve and sustain: audit, updates, cost, exit, and skills development.

390