Page 157 - Cyber Defense eMagazine April 2023

burden decision-makers, cybersecurity insurance premiums are peaking for those who worry about or
experience a breach.

While this may entice business leaders to look for affordable cybersecurity assessment auditing programs
above all, it's important to note the average cost of an enterprise data breach was $4.35 million in 2021.
So, while cost is an important factor in any business purchase, it should not and cannot be the only factor
when conducting a security assessment. Instead, when researching different cybersecurity auditing
partners and programs, Chief Information Security Officers (CISOs) should consider return on
assessment investment (ROAI).

Understanding ROAI measurements

ROAI measurements leverage a combination of factors, including an auditing firm's reputation and
resources—enabling leaders to take a more strategic approach to decision-making. It also considers the
working relationship that an auditing firm will have with a business, accounting for process-related
efficiencies and workflow synergies. In essence: it covers the largest impacts of a compliance program,
beyond cost.

Assessment firms with enhanced expertise, scale and capabilities of cybersecurity auditing can provide
higher quality and level of service with a lower operational cost per report. With ROAI in mind, businesses
are encouraged to dig deeper, beyond the dollars and cents, to determine which providers can bring the
auditing efficiencies and scope of auditing services needed to remain compliant, mitigate disruptions and
help the company save on costs later down the line. Most importantly, the customers that rely upon an
organization will better trust them if the organization is wholistically considering its audit partners.

Auditing efficiency and why it’s valuable

Businesses that aren’t considering ROAI tend to gravitate to the low-cost, “easy-button” providers they
see pop up in their newsfeeds, inboxes or while scrolling through social media. Unfortunately, those easily
recognizable providers that throw massive budgets into marketing campaigns to showcase their savings,
aren't always what they claim to be once a working relationship is established. And, when put into
practice, there are unforeseen "costs" to actually working with them. For low-cost cybersecurity auditing
firms, this is also true.

Everyone will claim they're efficient when pitching you, but oftentimes, low-cost audit firms will propose
and price their engagements based on a perfect case scenario. They disregard mentioning any add-on
fees for additional services or how they support you on an ongoing basis. Once a company signs a
contract, they are often at the mercy of the auditor. If the firm decides to enact several rounds of changes
to the original, agreed-upon audit contract—a tactic known as "amendment creep"—the company may
be subject to price increases and additional licensing audits that cost the business time, resources and
productivity, as well as their assurance that they chose the right provider.

157