Business Principles and Practices
Why security is a business function
Security competes for the same money as every other department, so justify proposals in business language: cost, benefit, risk reduction, and time to value. Understand the organization's mission, structure, and financial cycle. Know capital expense (assets with multi-year life such as CCTV and access control) versus operating expense (guard contracts, monitoring fees), and the difference between a budget request and a business case.
Financial tools
- ROI and payback period: simple and intuitive; payback ignores value after break-even.
- Net present value (NPV): discounts future cash flows; positive NPV adds value, and higher NPV wins when comparing alternatives.
- Lifecycle/total cost of ownership: purchase plus installation, maintenance, training, and replacement.
Traps: choosing the lowest purchase price, treating sunk costs as relevant, comparing alternatives over different time horizons, and forgetting labor and maintenance in ROI.
Operations and relationships
Metrics should tie to business outcomes (loss per shipment, incidents per 1,000 employees, mean time to resolve) rather than activity counts like patrols walked. Manage vendors with a clear statement of work, service-level agreements, and review meetings. Security supports HR, legal, IT, and facilities; treat them as stakeholders, not obstacles.
Worked example
Two badge systems: A costs $100k installed and $10k/yr over a 7-year life; B costs $60k and $22k/yr. Over seven years A totals $170k and B totals $214k, so B's lower sticker price is the more expensive choice. Put lifecycle cost and NPV at the company discount rate, plus reliability risk, into the business case.