Security: middle-markets firms split on spending.

Most middle-market companies view their current spending on security as a sound investment, but a large minority sees it as an expense that must be minimized, according to The Conference Board's latest report on corporate security practices. The survey covered nearly 100 chief executives and other top officers in a wide range of mid-sized companies (with annual revenues of between $20 million and $1 billion).

The report was sponsored by the U.S. Department of Homeland Security and was prepared for The Conference Board's 2,000 corporate members around the world. The survey shows that 61 percent endorse the business case argument that security provides value for their firms and a positive return on investment, but 39 percent say that security is simply a cost that must be tightly controlled. The strongest support for security spending is in the so-called "critical industries"--transportation, energy and utilities, financial services, media and telecommunications, information technology, and healthcare. Increases in security spending are lowest among the smallest companies.

Most surveyed companies, however, report little increase in security spending since 9/11. In fact, fully 45 percent say they have not increased their spending since the terrorist attacks in 2001 and 1 percent say they have actually cut back.

Approximately 21 percent of chief executives report that they meet with their top security officer at least weekly, and an additional 25 percent meet at least monthly. But 28 percent meet with their security directors only a few times a year, and 26 percent report that they have never met with the security chief at any time during the previous year.

Access of security officers to their CEO has a direct impact on security spending. Three-quarters of the companies that hold weekly security meetings with top executives report an increase in security spending since 9/11, compared to only 30 percent of those firms where the chief executive never meets. In companies with senior-level security meetings at least once a month, at least 30 percent report an increase in spending of 10 percent or more, compared with 19 percent of companies with occasional senior-level meetings and 9 percent of companies where the chief executive and security director never meet.

The study found that 71 percent of larger mid-market companies have board-approved written guidelines on disaster recovery and business continuity, compared with 43 percent of smaller companies. Only about one-third of mid-market companies, regardless of size, said their board has approved written policies dealing with routine security issues.