Metric Ownership Responsibility Matrix
Assigns who supplies, validates, interprets and reports each metric so no number arrives without an owner.
Available soon
- Format
- Excel
- Size
- 67 KB
- Length
- 11 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Responsibility Matrix. Each row is one metric from the Security KPI & KRI Catalogue, with the four duties: S Supplies (data supplier), V Validates (validator), I Interprets (metric owner), R Reports (reporter). The roles shown are those the catalogue suggests. |
| 2 | Mark each metric you run as In use (Yes). Only metrics in use are checked and counted. The EXAMPLE marks the 19 metrics the example organisation chose in the Security KPI & KRI Catalogue. |
| 3 | For each metric in use, name one post in each duty cell: one supplier, one validator, one metric owner, and a reporter for each audience the metric reaches. Every metric must have one owner, who interprets it and answers for it, and one data supplier for each input. Each is a person in a named role, never a team or a tool. |
| 4 | The supplier and the validator must be different people: "The person who validates an input must not be the person who supplied it." The check compares the posts, and the people who hold them on Role Holders. |
| 5 | On Role Holders, name who holds each role in your organisation, a deputy, and whether it is a person in a named role. A team, or a tool, cannot own or supply a metric (MR-03). Use the same post name in the matrix and on Role Holders, so the checks can find it. |
| 6 | On Duties and Cycle, enter the last day of the period. The dates show when each duty falls due in the monthly cycle. |
| 7 | Clear every Check on the matrix that does not say OK or Not in use, and every Role Holders check that does not say OK or Not used. The Ownership Check then says Every number has an owner. |
| 8 | Keep the matrix with the Security KPI & KRI Catalogue: when a metric is added or retired there, add or mark it here. Review both once a year (MR-11), and whenever a role holder changes. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. The holders come from its September cycle: Procurement Manager supplied and Information Security Manager validated MC-17; Information Security Manager supplied and Head of Information Security validated MC-28. Other holders are left for you to name.
Tailoring — small organisation: one person may hold several roles. The metric owner may also report, and the same manager may validate some metrics and supply others. The rule that never bends is MR-06: nobody validates an input they supplied. Where only one person knows a figure, have someone else validate it against its source.
Tailoring — regulated entity (NIS2, DORA): the NIS2 Implementing Regulation (EU) 2024/2690, Annex point 7.2, expects you to decide who measures, and who analyses and evaluates the results. This matrix, approved, is that record. Keep the executive committee reporter separate from the people whose controls the metrics judge.
Tailoring — IT run by a service provider: the provider may supply inputs, as a contract obligation. The validator and the metric owner stay inside your organisation.
Delegation: a deputy may act for a role while its holder is absent, and is bound by the same rule: never validate an input they supplied.
Colour in the Check columns only repeats the words beside it (MR-12).
Responsibility Matrix
S supplies · V validates, never the supplier (MR-06) · I interprets: the one metric owner (MR-03) · R reports, once per audience. Yellow cells are yours; the EXAMPLE marks the metrics in use.
| Metric ID | Metric | Owning pack | Type | Audience | In use | S — Supplies | V — Validates | I — Interprets: metric owner | R — Reports: security and IT leadership team | R — Reports: executive committee | One owner (calc) | Supplier and validator (calc) | Reporters (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MC-01 | Scan coverage | P01 | KPI | Operational | No | IT Operations Manager | Information Security Manager | Standard owner | Information Security Manager | — | Not in use | |||
| MC-02 | Mean time to remediate, by priority | P01 | KPI | Operational | No | IT Operations Manager | Information Security Manager | Standard owner | Information Security Manager | — | Not in use | |||
| MC-03 | Deadline adherence | P01 | KPI | Operational and executive | No | IT Operations Manager | Information Security Manager | Standard owner | Information Security Manager | Head of Information Security | Not in use | |||
| MC-04 | Overdue exposure | P01 | KRI | Operational and executive | No | IT Operations Manager | Information Security Manager | Standard owner | Information Security Manager | Head of Information Security | Not in use | |||
| MC-05 | Open exceptions by band | P02 | KPI | Operational | No | Control owner | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-06 | Expired exceptions | P02 | KPI | Operational and executive | No | Control owner | Information Security Manager | Head of Information Security | Information Security Manager | Head of Information Security | Not in use | |||
| MC-07 | Chronic exceptions | P02 | KPI | Operational | No | Control owner | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-08 | Unmitigated SoD conflicts | P02 | KRI | Operational and executive | No | Control owner | Information Security Manager | Head of Information Security | Information Security Manager | Head of Information Security | Not in use | |||
| MC-09 | Documents past review date | P04 | KPI | Operational | No | Policy Coordinator | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-10 | Documents in force without approval | P04 | KPI | Operational | No | Policy Coordinator | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-11 | Acknowledgement coverage | P04 | KPI | Operational | No | HR Manager | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-12 | Overdue acknowledgements | P04 | KPI | Operational | No | HR Manager | Information Security Manager | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-13 | Risks outside appetite and past tolerance | P05 | KRI | Operational and executive | Yes | Assessor | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-14 | Treatment actions overdue | P05 | KPI | Operational and executive | Yes | Head of Risk | Assessor | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-15 | Acceptances past review | P05 | KPI | Operational and executive | Yes | Assessor | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-16 | Risks not reviewed this quarter | P05 | KPI | Operational | No | Assessor | Head of Information Security | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-17 | Tier 1 suppliers assessed | P06 | KPI | Operational and executive | Yes | Procurement Manager | Assessor | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-18 | Reassessments overdue | P06 | KPI | Operational | No | Procurement Manager | Assessor | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-19 | High findings past deadline | P06 | KPI | Operational and executive | Yes | Assessor | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-20 | Concentration | P06 | KRI | Operational and executive | Yes | Procurement Manager | Assessor | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-21 | Reviews on time | P07 | KPI | Operational | No | Campaign coordinator | Head of Information Security | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-22 | Removals confirmed on time | P07 | KPI | Operational and executive | Yes | System administrator | Campaign coordinator | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-23 | Access that should not have existed | P07 | KRI | Operational | No | Campaign coordinator | Head of Information Security | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-24 | Process weaknesses open | P07 | KPI | Operational | Yes | Campaign coordinator | Head of Information Security | Head of Information Security | Information Security Manager | — | OK | OK | OK | OK |
| MC-25 | Significant incidents and time to contain | P09 | KPI | Operational and executive | Yes | Incident manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-26 | Reports made on time | P09 | KPI | Operational and executive | Yes | Incident manager | Data Protection Officer | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-27 | Review actions overdue | P09 | KPI | Operational and executive | Yes | Incident manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-28 | Months since the plan was last exercised | P09 | KPI | Operational and executive | Yes | Incident manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-29 | Audiences exercised within their interval | P10 | KPI | Operational and executive | Yes | Exercise lead | Exercise sponsor | Exercise lead | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-30 | Objectives met at the last exercise | P10 | KPI | Operational | No | Exercise lead | Exercise sponsor | Exercise lead | Information Security Manager | — | Not in use | |||
| MC-31 | Exercise actions overdue | P10 | KPI | Operational and executive | Yes | Exercise lead | Exercise sponsor | Exercise lead | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-32 | Re-tests outstanding | P10 | KPI | Operational | No | Exercise lead | Exercise sponsor | Exercise lead | Information Security Manager | — | Not in use | |||
| MC-33 | Critical suppliers exercised | P10 | KPI | Operational | No | Exercise lead | Exercise sponsor | Exercise lead | Information Security Manager | — | Not in use | |||
| MC-34 | Phishing compromises | P11 | KRI | Operational and executive | Yes | Incident manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-35 | Critical systems without a checked restore | P11 | KRI | Operational and executive | Yes | IT Operations Manager | Information Security Manager | Head of IT | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-36 | Staff security training completion | P11 | KPI | Operational and executive | Yes | HR Learning Lead | Information Security Manager | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-37 | Metrics reported with an approved card | P11 | KPI | Operational | No | Information Security Manager | Head of Information Security | Head of Information Security | Information Security Manager | — | Not in use | |||
| MC-38 | Figures that failed a quality check | P11 | KPI | Operational and executive | Yes | Information Security Manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-39 | KRI escalations made on time | P11 | KPI | Operational and executive | Yes | Information Security Manager | Head of Information Security | Head of Information Security | Information Security Manager | Head of Information Security | OK | OK | OK | OK |
| MC-40 | Metrics reviewed in the last 12 months | P11 | KPI | Operational | No | Information Security Manager | Head of Information Security | Head of Information Security | Information Security Manager | — | Not in use |
Role Holders
Each role the matrix names, who holds it and who deputises. The counts are duties on metrics in use. A role held by a team or a tool cannot supply or own a metric (MR-03).
| Role, as the matrix names it | Held by (post or person) | Deputy | Person, team or tool | Supplies (calc) | Validates (calc) | Interprets (calc) | Reports (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|
| IT Operations Manager | IT Operations Manager | [[Deputy post]] | Person in a named role | 1 | 0 | 0 | 0 | OK |
| Information Security Manager | Information Security Manager | [[Deputy post]] | Person in a named role | 2 | 2 | 0 | 19 | OK |
| Standard owner | [[e.g. Head of Information Security]] | [[Deputy post]] | 0 | 0 | 0 | 0 | Not used | |
| Control owner | [[e.g. IT Operations Manager]] | [[Deputy post]] | 0 | 0 | 0 | 0 | Not used | |
| Head of Information Security | Head of Information Security | [[Deputy post]] | Person in a named role | 0 | 10 | 16 | 18 | OK |
| Policy Coordinator | Policy Coordinator | [[Deputy post]] | 0 | 0 | 0 | 0 | Not used | |
| HR Manager | HR Manager | [[Deputy post]] | 0 | 0 | 0 | 0 | Not used | |
| Assessor | Information Security Manager | [[Deputy post]] | Person in a named role | 3 | 3 | 0 | 0 | OK |
| Head of Risk | Head of Risk | [[Deputy post]] | Person in a named role | 1 | 0 | 0 | 0 | OK |
| Procurement Manager | Procurement Manager | [[Deputy post]] | Person in a named role | 2 | 0 | 0 | 0 | OK |
| Campaign coordinator | [[e.g. Information Security Manager]] | [[Deputy post]] | Person in a named role | 1 | 1 | 0 | 0 | OK |
| System administrator | [[Name the post]] | [[Deputy post]] | Person in a named role | 1 | 0 | 0 | 0 | OK |
| Incident manager | Information Security Manager | [[Deputy post]] | Person in a named role | 5 | 0 | 0 | 0 | OK |
| Data Protection Officer | [[Name the post]] | [[Deputy post]] | Person in a named role | 0 | 1 | 0 | 0 | OK |
| Exercise lead | [[e.g. Head of Information Security, who owns the programme]] | [[Deputy post]] | Person in a named role | 2 | 0 | 2 | 0 | OK |
| Exercise sponsor | [[e.g. Chief Operating Officer, usually the executive incident lead]] | [[Deputy post]] | Person in a named role | 0 | 2 | 0 | 0 | OK |
| Head of IT | Head of IT | [[Deputy post]] | Person in a named role | 0 | 0 | 1 | 0 | OK |
| HR Learning Lead | HR Learning Lead | [[Deputy post]] | Person in a named role | 1 | 0 | 0 | 0 | OK |
Duties and Cycle
Duties and the monthly cycle
The four duties every metric needs, the rules the matrix is checked against, and when each duty falls due, in working days after the period end.
The four duties
| Code | Duty | Held by | What they do | Rule |
|---|---|---|---|---|
| S | Supplies | Data supplier | Provides each input from the named source, with its extract date, by the supply deadline. | MR-03 |
| V | Validates | Validator | Runs the completeness, freshness and plausibility checks, and accepts, returns or rejects each input. | MR-06 |
| I | Interprets | Metric owner | Sets the status or zone, writes the commentary, starts any escalation and answers questions on the metric. | MR-03 |
| R | Reports | Reporter | Puts validated values and the owner's commentary into the report for each audience, unchanged. | MR-10 |
The rules the matrix is checked against
| No. | Rule | |||
|---|---|---|---|---|
| 1 | Exactly one Supplies per input, one Validates, one Interprets and one Reports per audience. | |||
| 2 | Supplies and Validates are never the same person (MR-06). | |||
| 3 | Interprets is a person in a named role who can explain the number to the audience, never a team or a tool (MR-03). | |||
| 4 | A metric with an empty cell is not reported until the cell is filled (MR-02). | |||
The monthly cycle
| Period end | 30 Sep 2026 | EXAMPLE: September 2026. Enter the last day of your period. |
| Working day | Duty | Due (calc) | Step | |
|---|---|---|---|---|
| 3 | Supplies | 5 Oct 2026 | Inputs supplied in the collection workbook, each with its extract date | |
| 5 | Validates | 7 Oct 2026 | Quality checks run; each input accepted, corrected or rejected (MR-05, MR-06) | |
| 6 | Interprets | 8 Oct 2026 | KRI zones and KPI statuses set; commentary written; escalations started (MR-08) | |
| 7 | Reports | 9 Oct 2026 | Operational dashboard reviewed by the security and IT leadership team | |
| 8 | Reports | 12 Oct 2026 | Executive committee report sent | |
| 10 | Reports | 14 Oct 2026 | Executive committee meeting | |
Working days are Monday to Friday; add your public holidays to the WORKDAY formula if you need them. In the last month of a quarter the same figures feed the board report, whose cycle sets its own dates (P03).
Ownership Check
Ownership check
The metrics in use on the Responsibility Matrix, and the roles on Role Holders, against the rules. Every line should say 'Meets the check' before the first value is reported (MR-02).
Checks
| Check | Result | Status | What it means |
|---|---|---|---|
| Metrics in use | 19 | Meets the check | Marked Yes in the In use column. Each needs an approved definition card (MR-02). |
| Metrics in use with exactly one owner | 19 | Meets the check | Exactly one Supplies per input, one Validates, one Interprets and one Reports per audience. |
| Metrics in use whose supplier and validator differ | 19 | Meets the check | Supplies and Validates are never the same person (MR-06). |
| Metrics in use with a reporter for each audience | 19 | Meets the check | Metrics must be reported at the cadence of their audience: the security and IT leadership team monthly, the executive committee monthly, and the board quarterly through the P03 board report. |
| Metrics in use with a check to resolve | 0 | Meets the check | A metric with an empty cell is not reported until the cell is filled (MR-02). |
| Roles with a check to resolve | 0 | Meets the check | Interprets is a person in a named role who can explain the number to the audience, never a team or a tool (MR-03). |
| Overall | 0 | Every number has an owner | The number of checks above that do not yet say 'Meets the check'. |
EXAMPLE rows are counted until you replace them. A metric not in use is not checked.
Lists
| YesNo | Kind | Audience | Type |
|---|---|---|---|
| Yes | Person in a named role | Operational | KPI |
| No | Team | Operational and executive | KRI |
Tool or system
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| S — Supplies (data supplier) | Provides each input from the named source, with its extract date, by the supply deadline. (MR-03) |
| V — Validates (validator) | Runs the completeness, freshness and plausibility checks, and accepts, returns or rejects each input. (MR-06) |
| I — Interprets (metric owner) | Sets the status or zone, writes the commentary, starts any escalation and answers questions on the metric. (MR-03) |
| R — Reports (reporter) | Puts validated values and the owner's commentary into the report for each audience, unchanged. (MR-10) |
| Data supplier | The person who provides an input to a metric each period, from a named source. |
| Validator | The person who runs the quality checks on an input and accepts or rejects it. Never the person who supplied it. |
| Metric owner | The person who interprets a metric, writes the commentary and answers for it. One per metric. |
| Reporter | The person who puts validated values into the report for an audience. |
| Security and IT leadership team | Run the controls. Every catalogue metric the organisation uses, with trend, zone or status, and owner commentary. Monthly, through the Operational Security Metrics Dashboard. |
| Executive committee | Decide. The position against appetite, KRIs outside green, KPIs short of target, and the decisions the committee must take. Monthly, through the Executive Committee Security Report Deck. |
| In use | A metric the organisation reports, chosen in the Security KPI & KRI Catalogue. Only metrics in use are checked. |
| Person in a named role | One person, named by their post, who can explain the number. Not a team, a mailbox or a system (MR-03). |
| Deputy | The person who acts for a role holder while they are absent. The same rules bind them. |
| Metric | A number defined once, on a definition card, that answers one question for one audience: what is counted, how, from which source, by whom and how often. |
| Data quality | Whether an input can be relied on. This pack checks three things: completeness, freshness and plausibility. |
| MR-nn | The rules of the Security Metric Definition & Measurement Method (MR-01 to MR-12). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, its metrics in use for September 2026. Replace the In use marks and the holders with your own before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Responsibility Matrix and Role Holders: the four duties for every metric, assigned to named roles |
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | Supplies, Validates and Interprets: who monitors and measures, and who analyses and evaluates |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | The whole workbook: roles for metrics established, communicated and checked |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Responsibility Matrix and Duties and Cycle: who measures, when, and who analyses and evaluates |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA)