What are Security Performance Metrics and why do I need them?

Security performance metrics are quantitative measurements enriched with business context that provide comprehensive and contextual information on the current state and quality of an organization's security posture.  Metrics serve as performance indicators to provide insight into the:

• Effectiveness of information technology security initiatives and programs
• Impact that internal controls have on security and business operation
• Effectiveness of security policies, processes, and procedures
• Assessment of risk associated with resources, assets, and threats
• Compliance with standards, regulations, and governance objectives

Security performance metrics are the most effective way to systematically and consistently measure, analyze, and improve an organization's programs for IT security, compliance, governance, and risk.

How do I use Security Performance Metrics?

Security performance metrics provide insight into the efficiency and effectiveness of your IT security internal controls.  They serve to provide both hard evidence supporting the existence of security controls and quantitative support for assessing their value.  Well-constructed metrics highlight concentrations of risk and progress toward goal attainment. They provide insight into the impact of investments made in people, processes, and technologies to ensure compliance, implement best practices, and mitigate risk.  Scorecards provide evidence of regular review, analysis, and adjustment of IT security controls. 

To be maximally effective, metrics are to be communicated clearly and unambiguously to a variety of target audiences and within their business context.   A scorecard is an ideal medium for the communication of results associated with a collection of related metrics.  A scorecard can be organized to show the impact that security internal controls have on both the security posture of your organization as well as the business process that are critical to it.

Below is a scorecard for a web portal manager to monitor the effectiveness of access controls for an externally facing web application.  In this particular example, the scorecard is composed of metrics to characterize portal usage, access controls, support workload, customer response service levels, and labor cost.