How to explain the need/benefits of CISO/Infosec to the board?

Web: https://www.reddit.com/r/cybersecurity/comments/s0p3so/how_to_explain_the_needbenefits_of_cisoinfosec_to/

If the Board wants to understand the benefits that are derived from their spend on IT Security, what is a good way to quantify and present the information? Anyone have any good resources or a framework to use?

I’m thinking we should speak to risk reduction, use metrics of organizations with and without things like education programs to demonstrate the impact that educating the workforce has. Also thinking we should speak to the likelihood of events like ransomeware in our …

board ciso cybersecurity infosec