IT Security Reaches The TopIT Security Reaches The Top

Despite tight budgets, spending on IT security is rising. The bad news is that it partly reflects companies' skimpy spending on security in the past.

Half of companies in North America plan to increase IT security spending and more than a third more plan to keep it the same, according to information Research's Global Information Security Survey. Slightly fewer companies in South America, Europe, and Asia expect growth, because a higher percentage say they don't know what their spending will be.

But many smaller companies have a long way to go. A third of companies worldwide are spending $10,000 or less on security. Even for a small company, that barely covers the cost of antivirus software, a firewall, and the staff to administer it. Another 22% are spending less than $50,000. "Even if you've got 50 employees, $10,000 isn't much security," says Mark Lobel, PricewaterhouseCoopers' senior manager in security services.

When it comes to who's making the decisions about IT security spending and policies, Sept. 11 fueled a trend toward making IT security an important issue for the highest-level executives. About half of U.S. companies say the CEO, president, or managing director is involved in setting information-security policy. In the United States and worldwide, the CIO continues to be the most frequent leader of IT security.

However, security policy may be becoming less of a committee decision. The survey allows multiple responses so everyone who sets security policy can be cited. From 1999 to 2001, the percentage steadily rose for nearly every executive job category--including CIO, CEO, and chief information security officer--suggesting that more people were getting involved. This year brought a decrease in nearly every category, including the CIO, from 57% to 40%, suggesting that fewer companies list multiple executives as setting security policy.

Lobel has seen this trend at telecom, transportation, and financial-services companies, which have consolidated responsibility for IT security under one exec: "It's moving up the food chain."