Cyber Security 20/20: Power & Utilities Budgets, Staffing and Organizational Structure Benchmarks

Description

Cyber threats continue to pose substantial risk to companies’ operations and to power grids worldwide, and they continue to grow in number, source, frequency, sophistication and risk level.  As such, in the power production, transmission and distribution, and utilities sectors, the cyber security function continues to grow in importance as much as it continues to mature operationally.  Most power producers and utilities of size now have a fully matured cyber security function.

Today, companies face an increasingly complex regulatory environment.  Cyber security departments are not only responsible for executing plans to maintain a level of risk that is acceptable to boards of directors, shareholders, and executive management, but they also must ensure compliance with mandatory cyber security standards set by regulatory authorities around the globe, such as the Federal Energy Regulatory Commission (FERC) in the US.  Increasing regulatory requirements will impact both staffing and budgetary investments in the years ahead.  Resource allocation decisions also will be driven by changing workloads as new technologies enable greater automation, new sources of threats arise, and increasing threat levels will challenge electric power and utility companies to keep pace in order to maintain acceptable threat levels.

We developed this report to provide hard-to-find benchmark data on power and utility companies’ cyber security functions.  Specifically, the months-long research effort that culminated in this report examines and compares the budgets (including budget breakdowns into major spending categories), staffing levels, organizational structure composition, and projections for future changes in staffing and structure of the cyber security functions operating within a variety of power and utilities firms, including independent power producers (IPPs), investor-owned or privately-owned utilities (IOUs), public or municipal utilities (MUNIs), and cooperative utilities.  Data analyzed in this report compare cyber security staffing levels to broader IT department headcounts and total overall company headcounts, and we develop a cyber security staffing model framework which enables readers to compare their own cyber security staffing levels to industry-wide benchmark metrics.  The content for this report was gathered directly from senior-level cyber security, information technology (IT), information security, risk management / cyber risk management, and cyber program executives (including CIOs, vice presidents, directors and managers).

Data and Insights Included in This Report

• Cyber security department budgets, including budget breakdowns into major spending categories
• Projections for changes to cyber security budgets in the coming years, including factors driving those changes
• Cyber security staffing headcounts (internal employees and contract workers) broken down by seniority level
• Trends and analysis of companies’ future plans for staffing in the next few years, including factors driving changes to cyber security headcounts
• Analysis of cyber security organizational structures (stand-alone departments vs. multi-functional departments which include other functions, such as IT, risk management, corporate security, etc.)
• Comparisons of centralized, decentralized and matrix organizational structures
• Reporting relationships to executive management
• Plans for re-structuring cyber security departments in the next few years

Why Buy This Report

• Benchmark cyber security budgets and spending practices at power and utilities companies around the globe
• Compare your department’s staffing resources to those of other companies
• Right-size your department’s staffing levels
• Make the case to management for additional budget and staffing resources
• Understand how organizational structure supports or hinders business performance
• Inform decisions about departmental reorganizations