Best Practice Justification

[Srini Kolathur]

Formulation of IT security policies, standards and procedures;
project management framework; documentation of IT operations
procedures are critical controls. Security admins, Internal and
external auditors point out the importance of putting them in place
but management ignores them. No one can argue that they do not know
about these controls; perhaps they do not see immediate ROI, they only
see cost.

In these hard times when budgets are tight ( interestingly they have
always been), what do you do?

1. Keep on reminding management?

2. Get frustrated and keep mum?

3. Forget and think about other risks?

4. Devise other ways of convincing management?