# Exercise: Designing Your Metrics Framework

To develop business-relevant security metrics, begin by mapping security activities to business outcomes:

1. List your organization's top business objectives for the current fiscal year
2. Identify security activities that directly or indirectly support each objective
3. Define potential metrics that would demonstrate security's contribution
4. Prioritize metrics based on business impact and measurement feasibility

For each selected metric, use this template to ensure clarity of purpose and audience:

- [ ] Metric name: [Clear, descriptive title]
- [ ] Business alignment: [Specific business objective(s) supported]
- [ ] Target audience: [Primary stakeholders for this metric]
- [ ] Definition: [Precise description of what is being measured]
- [ ] Calculation method: [Formula or process for deriving the measurement]
- [ ] Data sources: [Systems or processes that provide required data]
- [ ] Collection frequency: [How often data is gathered]
- [ ] Reporting frequency: [How often metric is reported]
- [ ] Target/threshold: [Expected performance levels]
- [ ] Improvement indicates: [Whether increase or decrease represents improvement]
- [ ] Actions triggered: [Decisions or responses based on metric results]

Establishing baselines and targets is essential for meaningful measurement. For each metric:

- [ ] Determine current performance level (baseline)
- [ ] Research industry benchmarks for comparable organizations
- [ ] Establish improvement targets based on risk tolerance and resources
- [ ] Define thresholds for escalation and intervention

This structured approach ensures that security metrics are purposeful, actionable, and aligned with business priorities rather than merely reporting available data.

## Metric Definition

| Field | Description |
| --- | --- |
| Metric Name | Clear, descriptive title |
| Business Alignment | Specific business objective(s) supported |
| Target Audience | Primary stakeholders for this metric |
| Definition | Precise description of what is being measured |
| Calculation Method | Formula or process for deriving the measurement |
| Data Sources | Systems or processes that provide required data |
| Collection Frequency | How often data is gathered |
| Reporting Frequency | How often metric is reported |
| Target/Threshold | Expected performance levels |
| Improvement Indicates | Whether increase or decrease represents improvement |
| Actions Triggered | Decisions or responses based on metric results |

Table 3: Metric Definition

## Example Metrics by Category

### Financial Impact Metrics

1. Cost of Security Incidents

- Definition: Average financial impact of security incidents
- Business Alignment: Financial performance, cost management
- Calculation: Sum of direct and indirect costs from security incidents divided by number of incidents
- Improvement: Decrease indicates improvement

2. Security Investment ROI

- Definition: Return on investment for security controls
- Business Alignment: Capital allocation efficiency
- Calculation: (Value of prevented incidents - Cost of control) / Cost of control
- Improvement: Increase indicates improvement

### Risk Management Metrics

1. Risk Remediation Rate

- Definition: Percentage of identified high risks remediated within target timeframe
- Business Alignment: Risk governance, operational resilience
- Calculation: (Number of high risks remediated on time / Total high risks identified) × 100
- Improvement: Increase indicates improvement

2. Mean Time to Remediate

- Definition: Average time to fix critical vulnerabilities
- Business Alignment: Operational efficiency, risk reduction
- Calculation: Sum of days to remediate / Number of vulnerabilities
- Improvement: Decrease indicates improvement

### Business Enablement Metrics

1. Security Exception Processing Time

- Definition: Average time to process security exception requests
- Business Alignment: Business agility, time-to-market
- Calculation: Sum of processing time / Number of requests
- Improvement: Decrease indicates improvement

2. Security Review Completion Rate

- Definition: Percentage of security reviews completed on schedule
- Business Alignment: Project delivery timelines
- Calculation: (Number of reviews completed on time / Total required reviews) × 100
- Improvement: Increase indicates improvement

### Competitive Advantage Metrics

1. Security-Related Sales Wins

- Definition: Number of sales where security capabilities positively influenced the decision
- Business Alignment: Revenue growth, market share
- Calculation: Count of wins where security was cited as a factor
- Improvement: Increase indicates improvement

2. Third-Party Risk Assessment Performance

- Definition: Organization's security rating in customer/partner assessments
- Business Alignment: Strategic partnerships, supply chain
- Calculation: Average score across all third-party assessments
- Improvement: Increase indicates improvement

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)