Based on my experience as the CEO of a leading organization providing security services for the military and intelligence communities including the last four years, which I have spent as chairman of an e-business professional services company, I believe it is both necessary and possible to develop a practical, standardized measurement system for security. But, without the independence of the auditing community, such assurances will be without value, and companies, shareholders and the financial community will have no unbiased mechanism by which to judge the overall viability of an e-business. To provide such assurance is no easy task and requires the development of a method for measuring security, something that has been sorely missing. That rating would help stakeholder groups accurately assess a company's preparedness to deal with information security. Since no generally accepted system of measurement exists, the audit community has the chance to step up and play a critical role in defining the criteria on which a company's information security should be measured.
Systems change all the time, both technically and operationally.
A method of measurement must deal with not only current valuation, but also management of change. As an e-business partner , I'd like to be sure my fellow companies, many of whom are intimately linked with me via computer systems, are not likely to impact my company in an adverse manner. To provide such assurances, a competent independent audit, based on universal standards is necessary. To assure independence the auditors must stay clear of providing management or IT consulting services, which would result in a conflict between being a provider and being an assurer. It is in the best interests of the auditing community to police itself and to change controversial practices before Mr. Levitt and the SEC are forced to take more dramatic measures.