Internal personnel cost, including benefits, as a percentage of total IT cost, excluding depreciation/amortization

This measure calculates the cost of internal personnel (including benefits) as a percentage of the total IT cost. Personnel cost refers to employee personnel compensation (salaries and wages, bonuses, overtime and benefits) and fringe benefits (e.g. contributions made towards agovernment retirement fund for employees, workers compensation, insurance plans, savings plans, pension funds/retirement plans, stock purchase plans), and special allowances such as relocation expenses and car allowances. Total IT Cost or Budget (excluding depreciation/amortization; i.e., based on cash flow) includes operating and capital expenses for performing the entire IT function. Operating expenses are independent of including or excluding depreciation/amortization. Capital expenses should include costs for all capitalized IT assets acquired during the reporting period. The IT function concerns the development, delivery, support, and management of IT business/strategy, IT customer relationships, IT resilience/risk/security, IT information, and IT services/solutions. This Cost Effectiveness measure is intended to help companies understand this cost expenditure related to the process group "Manage IT resilience and risk".

Benchmark Data

Lock

Sorry! Not all users have access to all of our resources.

Want to unlock access to all of our resources?

Learn about Membership Arrow with stem
Measure Category:
Cost Effectiveness
Measure ID:
107897
Total Sample Size:
2,145 All Companies
Performers:
25th Median 75th
- - -
Key Performance Indicator:
No
Sample image showing interactive filters for more detailed measure peer group data and an interactive graph.

Compute this Measure

Units for this measure are percent.

Back to Top
Internal personnel cost as a percentage of total IT cost, excluding depreciation/amortization

Key Terms

There are no key terms associated with this measure.
Back to Top

Measure Scope

Back to Top

Cross Industry (7.4)

  • 8.3.1 - Develop IT compliance, risk, and security strategy (20707)
    • 8.3.1.1 - Determine and evaluate IT regulatory and audit requirements (20708)
    • 8.3.1.2 - Understand business unit risk tolerance (20940)
    • 8.3.1.3 - Establish IT risk tolerance (20709)
    • 8.3.1.4 - Establish risk ownership (20710)
    • 8.3.1.5 - Establish and maintain risk management roles (20711)
    • 8.3.1.6 - Establish compliance objectives (20712)
    • 8.3.1.7 - Identify systems to support compliance (20941)
    • 8.3.1.8 - Identify and evaluate IT risk (20713)
    • 8.3.1.9 - Evaluate IT-related risks resiliency (20714)
    • 8.3.1.10 - Create IT risk mitigation strategies and approaches (20715)
  • 8.3.2 - Develop IT resilience strategy (20716)
    • 8.3.2.1 - Determine IT delivery resiliency (20717)
    • 8.3.2.2 - Determine critical IT risks (20718)
    • 8.3.2.3 - Prioritize IT risks (20719)
    • 8.3.2.4 - Establish mitigation approaches for IT risks (20720)
  • 8.3.3 - Control IT risk, compliance, and security (20721)
    • 8.3.3.1 - Evaluate enterprise regulatory and compliance obligations (20722)
    • 8.3.3.2 - Analyze IT security threat impact (20723)
    • 8.3.3.3 - Create and maintain IT compliance requirements (20724)
    • 8.3.3.4 - Create and maintain IT security policies, standards, and procedures (20942)
    • 8.3.3.5 - Develop and deploy risk management training (20725)
    • 8.3.3.6 - Establish risk reporting capabilities and responsibilities (20726)
    • 8.3.3.7 - Establish communication standards (20727)
    • 8.3.3.8 - Conduct IT risk and threat assessments (20728)
    • 8.3.3.9 - Monitor and manage IT activity risk (20729)
    • 8.3.3.10 - Identify, supervise and monitor IT risk mitigation measures (20730)
  • 8.3.4 - Plan and manage IT continuity (20731)
    • 8.3.4.1 - Evaluate IT continuity (20732)
    • 8.3.4.2 - Identify IT continuity gaps (20733)
    • 8.3.4.3 - Manage IT business continuity (20734)
  • 8.3.5 - Develop and manage IT security, privacy, and data protection (20735)
    • 8.3.5.1 - Assess IT regulatory and confidentiality requirements and policies (20736)
    • 8.3.5.2 - Create IT security, privacy, and data protection risk governance (20737)
    • 8.3.5.3 - Define IT data security and privacy policies, standards, and procedures (20738)
    • 8.3.5.4 - Review and monitor physical and logical IT data security measures (20739)
    • 8.3.5.5 - Review and monitor application security controls (20740)
    • 8.3.5.6 - Review and monitor IT physical environment security controls (20741)
    • 8.3.5.7 - Monitor/analyze network intrusion detection data and resolve threats (20742)
  • 8.3.6 - Conduct and analyze IT compliance assessments (20743)
    • 8.3.6.1 - Conduct projects to enhance IT compliance and remediate risk (20744)
    • 8.3.6.2 - Conduct IT compliance control auditing of internal and external services (20745)
    • 8.3.6.3 - Perform IT compliance reporting (20746)
    • 8.3.6.4 - Identify and escalate IT compliance issues and remediation requirements (20747)
    • 8.3.6.5 - Support external audits and reports (20748)
  • 8.3.7 - Develop and execute IT resilience and continuity operations (20749)
    • 8.3.7.1 - Conduct IT resilience improvement projects (20750)
    • 8.3.7.2 - Develop, document, and maintain IT business continuity planning (20751)
    • 8.3.7.3 - Implement and enforce change control procedures (20752)
    • 8.3.7.4 - Execute recurring IT service provider business continuity (20753)
    • 8.3.7.5 - Provide IT resilience training (20754)
    • 8.3.7.6 - Execute recurring IT business operations continuity (20755)
  • 8.3.8 - Manage IT user identity and authorization (20756)
    • 8.3.8.1 - Support integration of identity and authorization policies (20757)
    • 8.3.8.2 - Manage IT user directory (20758)
    • 8.3.8.3 - Manage IT user authorization (20759)
    • 8.3.8.4 - Manage IT user authentication mechanisms (20760)
    • 8.3.8.5 - Audit IT user identity and authorization systems (20761)
    • 8.3.8.6 - Respond to IT information security and network breaches (20762)
    • 8.3.8.7 - Conduct penetration testing (20763)
    • 8.3.8.8 - Audit integration of user identity and authorization systems (20764)