Information Security Governance Metrics

A metric is a measurement of a process to determine how well the process is performing. Security-related metrics indicate how well the controls can mitigate the risks. For example, a system uptime metric helps in understanding whether a system is available to a user as per the requirements.

Figure 1.10: Information security governance metrics

The Objective of Metrics

Based on effective metrics, an organization evaluates and measures the achievement and performance of various processes and controls. The main objective of a metric is to help the management in decision-making. A metric should be able to provide relevant information to the recipient so that informed decisions can be made.

Technical Metrics vis-à-vis Governance-Level Metrics

Technical metrics help us to understand the functioning of technical controls such as IDSs, firewalls, and antivirus software. They are useful for tactical operational management. However, these metrics have little value from a governance standpoint.

Management is more concerned about the overall security posture of the organization. Full audits and comprehensive risk assessments are a few of the activities that help management to understand security from a governance perspective.

Characteristics of Effective Metrics

Good metrics should be SMART, that is, specific, measurable, attainable, relevant, and timely, as detailed below:

• Specific: The metric should be specific, clear, and concise.
• Measurable: The metric should be measurable so that it can be compared over a period.
• Attainable: The metric should be realistic and achievable.
• Relevant: The metric should be linked to specific risks or controls.
• Timely: The metric should be able to be monitored on a timely basis.

Key Aspects from the CISM Exam Perspective

The following are some key aspects from the exam perspective:

Questions	Possible Answer
What is the prime objective of a metric?	Decision-making takes place based on effective metrics. Organizations evaluate and measure the achievements and performance of various processes and controls using metrics. Effective metrics are primarily used for security-related decision-making.

Figure 1.11: Key aspects from the CISM exam perspective

Practice Question Set 8

1. As an information security manager, your decisions should be primarily based on:
   1. Market research
   2. Predictive analysis
   3. Industry standards
   4. Effective metrics
2. Which of the following metrics is considered to have the most important strategic value?
   1. A privileged access management process
   2. Trends in incident occurrence
   3. System downtime analysis
   4. Results of penetration tests
3. What is the most important metric that indicates organizational risk?
   1. The expected annual loss
   2. The number of security incidents
   3. The number of unplanned business interruptions
   4. The number of open vulnerabilities
4. What is the most essential attribute for a metric?
   1. Metrics should be easy to implement
   2. Metrics should be meaningful to the process owner
   3. Metrics should be qualitative
   4. Metrics should be able to support regulatory requirements
5. What is the most important attribute of a key risk indicator?
   1. A KRI should be flexible and adaptable
   2. A KRI should be arrived at by consistent methodologies and practices
   3. A KRI should be easy to understand
   4. A KRI should be convenient for the process owner to use
6. What is the best indicator to determine the effectiveness of the security strategy?
   1. The strategy helps to improve the risk appetite of the organization
   2. The strategy helps to implement countermeasures for all the threats
   3. The strategy helps to minimize the annual losses
   4. The strategy helps to achieve the control objectives
7. The information security manager has been asked to implement a particular security standard. Which of the following is the most effective to monitor this?
   1. The key success factor
   2. The key objective indicator
   3. The key performance indicator
   4. The key goal indicator