Canadian companies falling behind global counterparts on some information security initiatives: PwC report

Canadian companies are on par with the global average in their adoption of mobile and social media, and they are above average at not reducing their information security-related budgets, but they fall behind in a number of other information security initiatives, according to a survey by PwC Canada.

The survey, Eye of the Storm, included more than 9,600 global C-suite executives, 237 from Canada. The survey was conducted between February and April 2011.

Overall, the survey found Canadian companies tended to focus on regulatory compliance rather than risk management, essentially preferring to await government direction before taking initiative on information security risk-related matters.

Specifically, the survey identified four characteristics of companies with leading information security policies and procedures. They include and overall strategy in place, reporting to senior executives, measuring the effectiveness of information security and understanding security events that occur in the organization.

While Canada is on par with or excelled on social media adoption and lower budget cuts for information management, the country fell behind the global average in a number of other areas.

For example, in Canada, “the chief information security officer (CISO) or equivalent security leader is less likely to be reporting to the top of the house” than their global counterparts, the report noted.

Canadian CISOs are 10% less likely to report to a chief security officer (CSO), 5% less likely to report to a chief financial officer (CFO), 2% less likely to report to a chief executive officer (CEO) and 9% less likely to report to the company’s board of directors.

On the other hand, Canadian CISOs are 10% more likely than their global counterparts to report to a chief information officer (CIO).

Also, “the effectiveness of the information security policies and procedures aren’t reviewed as often in Canada as they are globally, and Canadian leaders are also less likely to have less insight into the security events that have occurred in their firm in the last 12 months,” the PwC reported.

The full report can be found at:

http://www.pwc.com/en_CA/ca/technology-consulting/security/publications/pwc-security-survey-2012-02-en.pdf