Metrics Programme Maturity Self-Check

Scores an existing metrics set for decision value, data quality and audience fit, and lists the metrics to drop.

Available soon

Answer it online instead: How mature is our metrics programme?About 10 minutes, free, and nothing is stored.

Format: Excel
Size: 75 KB
Length: 12 sheets
Version: 1.0
Updated: 29 Sep 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.029 Sep 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Scope: the metrics your organisation reports today on security, to anyone: the IT team's monthly pack, the executive report, the board report. List each one once, whatever its source. Answer for what happens now, not what the policy says.
2	On the Dimensions sheet, read the four descriptions for each dimension (columns F to I). Choose the one that matches what happens today in column L (Your level). If you are between two, choose the lower. Note what shows it in column M.
3	On the Metric Review sheet, enter each metric on its own row in column B, then answer Yes or No to each of the six questions in columns D to I. The questions are on the Review Questions sheet, with the rule each one tests. Answer No if you are unsure.
4	Optionally, name the weakness in column C (the words are the Board Metric Selection Catalogue's) and, for a metric to drop or fix, the catalogue metric that replaces it in column J (Security KPI & KRI Catalogue).
5	On the Results sheet, change cell D5 from 'Example profile' to 'My answers'. The levels, the next actions and both lists now describe your programme.
6	Start with next action 1. Drop every metric on the drop list at the next reporting period, keeping its card and the reason (MR-11). Fix the others before their next report, or move them to the audience that decides on them.
7	Copy the Export table (paste as values) into your records. Repeat the self-check once a year, with the annual metric review (MR-11), and compare.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The worked EXAMPLE. Column J of the Dimensions sheet holds the EXAMPLE firm's level for each dimension, with its reason in column K: its self-check as at 30 Sep 2026, on the running programme, after its first 3 monthly cycles (July to September 2026). The rows marked EXAMPLE on the Metric Review sheet are its metric review so far: the 6 metrics its IT team reported before it adopted the programme, reviewed at adoption on 26 Jun 2026. While Results cell D5 says 'Example profile', every result is calculated from these and labelled EXAMPLE. EXAMPLE firm: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders.

To clear the example: set Results cell D5 to 'My answers'. Rows marked EXAMPLE are then left out of every result; delete them when you no longer need them. To remove the example levels completely, also delete Dimensions cells J4 to K11.

Answer scale. 1 Not in place: The practice does not exist, or happens only by chance. 2 Informal: It happens, but depends on particular people and is not written down or not done consistently. 3 Defined: It is written down, agreed and done routinely, and leaves a record. 4 Managed: As Defined, and it is also measured, checked by someone else and improved. Each dimension describes each level in its own terms.

How results are worked out. Each dimension's result is its level in words. The next actions are the dimensions at the lowest level found, then the next lowest, earlier dimensions first, up to three. A dimension at Managed gives no action. There is no overall score. A metric's outcome: Drop when MQ-1 is No. A metric that informs no decision is retired (MR-11), whatever else it does well. Fix when MQ-1 is Yes and any other answer is No. Fix the gaps before the next period, or move it to the right audience. Keep when every answer is Yes.

Tailoring — small organisation: 'Defined' can be light. One page of definition cards and a shared spreadsheet count. Aim for Defined on every dimension before Managed on any, and review the few metrics you have rather than inventing more.

Tailoring — regulated entity (NIS2, DORA): the Implementing Regulation (EU) 2024/2690 Annex point 7.3 expects measurement policies and procedures to be reviewed at planned intervals and after significant incidents, and DORA Article 13(4) expects a financial entity to monitor how well its strategy is working. Keep each completed self-check, with its evidence notes, as a record of that review.

Tailoring — IT run by a service provider: many metrics come from the provider's own reports. Answer MQ-2, MQ-3 and MQ-6 for what you can see and check, not what the provider says. A provider's report that nobody in your organisation decides on is a candidate to drop from your own reporting.

Limitations: see the foot of the Results sheet.

Dimensions

Choose the level that matches what happens today in column L. Column J is the worked EXAMPLE. Columns N and O calculate; do not type in them.

No.	ID	Dimension	Question	Rules	1 — Not in place	2 — Informal	3 — Defined	4 — Managed	Example level (EXAMPLE)	Example evidence (EXAMPLE)	Level used (calc)	Level no. (calc)	Document that helps
1	MD-01	Decision link	Does every metric answer a question tied to a decision?	MR-01	Metrics are what the tools produce.	Some metrics have a purpose that people could state if asked.	Each metric's question and decision are written on its card.	As Defined, and the annual review checks that each metric informed a decision, with examples.	Defined	Every executive metric's card states its question and decision.	Defined	3	Metric Definition Card Template
2	MD-02	Definitions	Is every metric defined once, and used the same way everywhere?	MR-02, MR-04	Metrics have no written definition.	Some metrics are defined, in different places and words.	Every reported metric has an approved card, and other packs' definitions are used unchanged.	As Defined, and a check each period confirms every report uses the card's definition.	Defined	Cards are approved for every reported metric, and other packs' definitions are used unchanged.	Defined	3	Metric Definition Card Template
3	MD-03	Ownership	Does every number arrive with an owner?	MR-03, MR-06	Nobody is named for the metrics.	Owners are known informally, or the same person supplies and checks.	The responsibility matrix names Supplies, Validates, Interprets and Reports for every metric, and supplier and validator differ.	As Defined, and gaps in the matrix are found and filled before the next cycle.	Defined	The matrix names all four roles, and supplier and validator differ everywhere.	Defined	3	Metric Ownership Responsibility Matrix
4	MD-04	Data quality	Are figures checked before anyone sees them?	MR-05	Figures are reported as supplied.	Someone looks over the figures, without set checks.	Completeness, freshness and plausibility checks run on every input, with the outcome recorded.	As Defined, and failures are counted, reported and used to fix their sources.	Defined	Checks run on every input; September caught two failures. Failures are not yet traced back to fix their sources.	Defined	3	Metrics Data Collection & Quality Workbook
5	MD-05	Thresholds and escalation	Do KRIs have thresholds tied to appetite, and are breaches escalated?	MR-07, MR-08	No targets or thresholds.	Targets exist, but KRI thresholds are not tied to appetite, or breaches are handled case by case.	Every KRI has thresholds set from its linked risk's appetite and tolerance, and breaches are escalated as the table sets.	As Defined, and escalations are timed and reported, and thresholds are reviewed when appetite changes.	Defined	KRI thresholds are set from appetite, and the September breach was escalated on time.	Defined	3	Key Risk Indicator Threshold & Escalation Model
6	MD-06	Audience and cadence	Does each audience get the metrics it decides on, when it needs them?	MR-10, MR-12	One report goes to everyone, when someone asks.	Reports exist for some audiences, at irregular times.	Operational and executive reports go monthly and the board report quarterly, each with status in words.	As Defined, and each audience confirms once a year that its report serves its decisions.	Defined	Monthly operational and executive reports, and the quarterly board report.	Defined	3	Executive Committee Security Report Deck
7	MD-07	Consistency between periods	Can this period be compared with the last?	MR-09	Definitions and sources change without notice.	Changes are known to the team but not recorded.	Every change is on the card with its date, and breaks in a series are marked.	As Defined, and earlier values are restated where the change allows it.	Informal	Changes before July 2026 were not recorded, so earlier trends cannot be trusted: MC-36's June figure is on the old definition.	Informal	2	Metric Definition Card Template
8	MD-08	Review and retirement	Are metrics that drive no decision dropped?	MR-11	Metrics are only ever added.	Metrics are dropped now and then, without a rule.	Every metric is reviewed once a year against the review questions, and retired metrics keep their card and reason.	As Defined, and the number of metrics in use stays level or falls as new ones are added.	Informal	No annual review yet: the first is due in [[Q2 2027]]. Five of the 6 metrics used before were dropped or replaced at adoption, in a one-off review; the yearly review is not yet set.	Informal	2	Security Metric Definition & Measurement Method

Metric Review

One row per metric you report today. Answer Yes or No in columns D to I (the questions are on the Review Questions sheet). Columns L to P calculate. Rows marked EXAMPLE are the worked example.

Row	Metric	Weakness (optional)	MQ-1 Decision value	MQ-2 One definition	MQ-3 Data quality	MQ-4 Audience fit	MQ-5 Target or thresholds	MQ-6 Ownership	Replaced by (optional)	Counted (calc)	Outcome (calc)	Answered No (calc)	Drop key (calc)	Fix key (calc)
EXAMPLE	Attacks blocked by the firewall	Vanity	No	No	Yes	No	No	No		Yes	Drop	MQ-1, MQ-2, MQ-4, MQ-5, MQ-6	30	0
EXAMPLE	Spam emails blocked	Vanity	No	No	Yes	No	No	No		Yes	Drop	MQ-1, MQ-2, MQ-4, MQ-5, MQ-6	29	0
EXAMPLE	Backup jobs completed successfully	Lacks context	No	No	Yes	No	No	Yes	MC-35 Critical systems without a checked restore	Yes	Drop	MQ-1, MQ-2, MQ-4, MQ-5	28	0
EXAMPLE	Access reviews completed	Gaming	Yes	No	No	Yes	Yes	Yes	MC-22 Removals confirmed on time	Yes	Fix	MQ-2, MQ-3	0	27
EXAMPLE	Security training completion		Yes	No	Yes	Yes	Yes	Yes	MC-36 Staff security training completion	Yes	Fix	MQ-2	0	26
EXAMPLE	Significant incidents and time to contain		Yes	Yes	Yes	Yes	Yes	Yes		Yes	Keep		0	0

Review Questions

The six questions each metric is asked, what each tests, and the rule behind it. Answer No if you are unsure: a No is a prompt to look, not a verdict.

ID	Tests	Question	Rule	What the rule says
MQ-1	Decision value	Did it change or confirm a decision in the last 12 months?	MR-01	Every metric must answer a stated question tied to a decision that a named audience takes. A metric that informs no decision is not collected.
MQ-2	One definition	Does it have an approved card, used unchanged by every report that shows it?	MR-02	Every metric must have an approved definition card before its first value is reported. The card is the only definition, and every document that shows the metric uses it.
MQ-3	Data quality	Did its inputs pass the quality checks in each of the last three periods?	MR-05	Every input must pass the completeness, freshness and plausibility checks before a figure is reported. A figure that fails is corrected, reported with a printed caveat, or withheld. It is never reported silently, and never replaced by last period's value.
MQ-4	Audience fit	Does it reach the audience that takes the decision, at that audience's cadence?	MR-10	Metrics must be reported at the cadence of their audience: the security and IT leadership team monthly, the executive committee monthly, and the board quarterly through the P03 board report.
MQ-5	Target or thresholds	Does it have a target (KPI) or thresholds tied to appetite (KRI)?	MR-07	Every KPI must have a target, and every KRI green, amber and red thresholds. A KRI's thresholds are set from the appetite and tolerance of the risk it indicates (P05) and approved by that risk's owner.
MQ-6	Ownership	Does it have one owner and one supplier per input, who are different people from the validator?	MR-03	Every metric must have one owner, who interprets it and answers for it, and one data supplier for each input. Each is a person in a named role, never a team or a tool.

What the answers decide

Outcome	When
Drop	MQ-1 is No. A metric that informs no decision is retired (MR-11), whatever else it does well.
Fix	MQ-1 is Yes and any other answer is No. Fix the gaps before the next period, or move it to the right audience.
Keep	Every answer is Yes.

Weakness words (optional, column C of the Metric Review)

Weakness	What it means
Vanity	Looks impressive and always moves the right way, but no decision would change because of it (for example, attacks blocked).
Gaming	Can be improved by changing what is counted rather than by reducing risk (for example, narrowing what counts as critical).
Lagging	Shows harm or failure only after it has happened, so it cannot warn the board in time on its own.
No target	No level can be called good or bad, so the board cannot judge it and can only ask 'so what?'.
Lacks context	A count or average with no denominator, weighting or comparison, so a rise or fall can mean opposite things.

Results

Results

Each dimension's result is its level in words. There is no overall score. The next actions and both lists follow from the rules written out at the foot of the sheet.

Results are calculated from:

Example profile

← choose 'My answers' once you have filled in column L of the Dimensions sheet and your rows of the Metric Review sheet.

EXAMPLE: these results are for the worked example, not your organisation. Choose 'My answers' in D5 to see your own.

Result by dimension

No.	Dimension	Level	What this level looks like here	Evidence	Rules	Level no.	Action key
1	Decision link	Defined	Each metric's question and decision are written on its card.	Every executive metric's card states its question and decision.	MR-01	3	108
2	Definitions	Defined	Every reported metric has an approved card, and other packs' definitions are used unchanged.	Cards are approved for every reported metric, and other packs' definitions are used unchanged.	MR-02, MR-04	3	107
3	Ownership	Defined	The responsibility matrix names Supplies, Validates, Interprets and Reports for every metric, and supplier and validator differ.	The matrix names all four roles, and supplier and validator differ everywhere.	MR-03, MR-06	3	106
4	Data quality	Defined	Completeness, freshness and plausibility checks run on every input, with the outcome recorded.	Checks run on every input; September caught two failures. Failures are not yet traced back to fix their sources.	MR-05	3	105
5	Thresholds and escalation	Defined	Every KRI has thresholds set from its linked risk's appetite and tolerance, and breaches are escalated as the table sets.	KRI thresholds are set from appetite, and the September breach was escalated on time.	MR-07, MR-08	3	104
6	Audience and cadence	Defined	Operational and executive reports go monthly and the board report quarterly, each with status in words.	Monthly operational and executive reports, and the quarterly board report.	MR-10, MR-12	3	103
7	Consistency between periods	Informal	Changes are known to the team but not recorded.	Changes before July 2026 were not recorded, so earlier trends cannot be trusted: MC-36's June figure is on the old definition.	MR-09	2	202
8	Review and retirement	Informal	Metrics are dropped now and then, without a rule.	No annual review yet: the first is due in [[Q2 2027]]. Five of the 6 metrics used before were dropped or replaced at adoption, in a one-off review; the yearly review is not yet set.	MR-11	2	201

Dimensions at each level

Not in place: 0 · Informal: 2 · Defined: 6 · Managed: 0 · Not answered: 0

A count, not a score.

Next actions (up to three)

#	Dimension	Level now	Next action	Rules	Document that helps	Action key	Row
1	Consistency between periods	Informal	Reach 'Defined': Every change is on the card with its date, and breaks in a series are marked.	MR-09	Metric Definition Card Template	202	7
2	Review and retirement	Informal	Reach 'Defined': Every metric is reviewed once a year against the review questions, and retired metrics keep their card and reason.	MR-11	Security Metric Definition & Measurement Method	201	8
3	Decision link	Defined	Reach 'Managed': As Defined, and the annual review checks that each metric informed a decision, with examples.	MR-01	Metric Definition Card Template	108	1

The metric set

Outcome	Metrics	What it means
Metrics reviewed	6	Rows counted: the EXAMPLE rows of the Metric Review sheet with a metric named.
Drop	3	MQ-1 is No. A metric that informs no decision is retired (MR-11), whatever else it does well.
Fix	2	MQ-1 is Yes and any other answer is No. Fix the gaps before the next period, or move it to the right audience.
Keep	1	Every answer is Yes.
Not answered	0	MQ-1 is Yes or blank, and at least one question is blank. Answer every question.

By review question

Question	Tests	Answered Yes	Answered No	In words
MQ-1	Decision value	3	3	3 of 6 metrics answered Yes
MQ-2	One definition	1	5	1 of 6 metrics answered Yes
MQ-3	Data quality	5	1	5 of 6 metrics answered Yes
MQ-4	Audience fit	3	3	3 of 6 metrics answered Yes
MQ-5	Target or thresholds	3	3	3 of 6 metrics answered Yes
MQ-6	Ownership	4	2	4 of 6 metrics answered Yes

Metrics to drop

#	Metric	Weakness	Why it goes	Replaced by	Drop key	Row
1	Attacks blocked by the firewall	Vanity	Informs no decision (MQ-1). Retire it, keeping its card and the reason (MR-11).		30	1
2	Spam emails blocked	Vanity	Informs no decision (MQ-1). Retire it, keeping its card and the reason (MR-11).		29	2
3	Backup jobs completed successfully	Lacks context	Informs no decision (MQ-1). Retire it, keeping its card and the reason (MR-11).	MC-35 Critical systems without a checked restore	28	3

Metrics to fix

#	Metric	Answered No	What to fix	Replaced by		Fix key	Row
1	Access reviews completed	MQ-2, MQ-3	Close each gap before the next report, or move the metric to the audience that decides on it.	MC-22 Removals confirmed on time		27	4
2	Security training completion	MQ-2	Close each gap before the next report, or move the metric to the audience that decides on it.	MC-36 Staff security training completion		26	5

How the results are worked out

1. Level: the level you chose for each dimension on the Dimensions sheet, in words. Each dimension's result is its level in words. The next actions are the dimensions at the lowest level found, then the next lowest, earlier dimensions first, up to three. A dimension at Managed gives no action. There is no overall score.

2. Action key (column I) = (4 − level number) × 100 + (9 − dimension number). The lowest levels come first and, at the same level, the earlier dimension. A dimension at Managed or not answered has key 0 and gives no action.

3. Next action: the description of the next level up for that dimension, from its row on the Dimensions sheet, with the pack document that helps.

4. Metric outcome: Drop when MQ-1 is No. A metric that informs no decision is retired (MR-11), whatever else it does well. Fix when MQ-1 is Yes and any other answer is No. Fix the gaps before the next period, or move it to the right audience. Keep when every answer is Yes.

5. The lists: every metric whose outcome is Drop, then every metric whose outcome is Fix, each in the order of the Metric Review sheet.

Limitations

This is a self-check. It is only as accurate as the answers, and people tend to answer for what the policy says rather than what happens. The evidence columns are the best check; a second person answering separately is better still.

It assesses how the metrics programme works, not whether security is good. A Managed programme can report a poor position accurately: that is its job.

The levels are not a benchmark. They cannot be compared with other organisations or with any certification requirement, and they are not added up: there is no overall score.

The metric review asks six questions of each metric. A metric kept after the review still needs its definition card, thresholds or target, and owner in place before it is reported (MR-02).

Export

Every answer and result in one table. Select the table, copy, and paste as values into your records. Everything here is calculated; do not type in it.

Section	Ref	Name	Detail	Result	Note
Source			Answers used	Example profile	EXAMPLE: these results are for the worked example, not your organisation. Choose 'My answers' in D5 to see your own.
Dimension	MD-01	Decision link	Each metric's question and decision are written on its card.	Defined	Every executive metric's card states its question and decision.
Dimension	MD-02	Definitions	Every reported metric has an approved card, and other packs' definitions are used unchanged.	Defined	Cards are approved for every reported metric, and other packs' definitions are used unchanged.
Dimension	MD-03	Ownership	The responsibility matrix names Supplies, Validates, Interprets and Reports for every metric, and supplier and validator differ.	Defined	The matrix names all four roles, and supplier and validator differ everywhere.
Dimension	MD-04	Data quality	Completeness, freshness and plausibility checks run on every input, with the outcome recorded.	Defined	Checks run on every input; September caught two failures. Failures are not yet traced back to fix their sources.
Dimension	MD-05	Thresholds and escalation	Every KRI has thresholds set from its linked risk's appetite and tolerance, and breaches are escalated as the table sets.	Defined	KRI thresholds are set from appetite, and the September breach was escalated on time.
Dimension	MD-06	Audience and cadence	Operational and executive reports go monthly and the board report quarterly, each with status in words.	Defined	Monthly operational and executive reports, and the quarterly board report.
Dimension	MD-07	Consistency between periods	Changes are known to the team but not recorded.	Informal	Changes before July 2026 were not recorded, so earlier trends cannot be trusted: MC-36's June figure is on the old definition.
Dimension	MD-08	Review and retirement	Metrics are dropped now and then, without a rule.	Informal	No annual review yet: the first is due in [[Q2 2027]]. Five of the 6 metrics used before were dropped or replaced at adoption, in a one-off review; the yearly review is not yet set.
Next action	Action 1	Consistency between periods	Reach 'Defined': Every change is on the card with its date, and breaks in a series are marked.	Informal	Document: Metric Definition Card Template
Next action	Action 2	Review and retirement	Reach 'Defined': Every metric is reviewed once a year against the review questions, and retired metrics keep their card and reason.	Informal	Document: Security Metric Definition & Measurement Method
Next action	Action 3	Decision link	Reach 'Managed': As Defined, and the annual review checks that each metric informed a decision, with examples.	Defined	Document: Metric Definition Card Template
Metric	EXAMPLE	Attacks blocked by the firewall	MQ-1, MQ-2, MQ-4, MQ-5, MQ-6	Drop
Metric	EXAMPLE	Spam emails blocked	MQ-1, MQ-2, MQ-4, MQ-5, MQ-6	Drop
Metric	EXAMPLE	Backup jobs completed successfully	MQ-1, MQ-2, MQ-4, MQ-5	Drop	Replaced by MC-35 Critical systems without a checked restore
Metric	EXAMPLE	Access reviews completed	MQ-2, MQ-3	Fix	Replaced by MC-22 Removals confirmed on time
Metric	EXAMPLE	Security training completion	MQ-2	Fix	Replaced by MC-36 Staff security training completion
Metric	EXAMPLE	Significant incidents and time to contain		Keep

Metric set	Metrics reviewed	6
Metric set	Drop	3
Metric set	Fix	2
Metric set	Keep	1
Metric set	Not answered	0

Lists

ResultsMode	LevelName	LevelMeaning	YesNo	Weakness
Example profile	Not in place	The practice does not exist, or happens only by chance.	Yes	Vanity
My answers	Informal	It happens, but depends on particular people and is not written down or not done consistently.	No	Gaming
	Defined	It is written down, agreed and done routinely, and leaves a record.		Lagging
	Managed	As Defined, and it is also measured, checked by someone else and improved.		No target

Lacks context

Definitions

Definitions

Term	Meaning in this workbook
Dimension	One of the 8 parts of a metrics programme this self-check places at a level, MD-01 to MD-08, each tied to the rules of the Security Metric Definition & Measurement Method.
1 — Not in place	The practice does not exist, or happens only by chance.
2 — Informal	It happens, but depends on particular people and is not written down or not done consistently.
3 — Defined	It is written down, agreed and done routinely, and leaves a record.
4 — Managed	As Defined, and it is also measured, checked by someone else and improved.
Next action	The description of the next level up, for one of the dimensions at the lowest level found. Up to three are given.
Metric review	Six questions, MQ-1 to MQ-6, asked of each metric reported today. Done once a year for every metric in use (MR-11).
Drop	MQ-1 is No. A metric that informs no decision is retired (MR-11), whatever else it does well.
Fix	MQ-1 is Yes and any other answer is No. Fix the gaps before the next period, or move it to the right audience.
Keep	Every answer is Yes.
Not answered	A metric with a blank answer, other than one already dropped by MQ-1.
Weakness	The Board Metric Selection Catalogue's word for how a metric misleads: Vanity, Gaming, Lagging, No target or Lacks context.
Metric	A number defined once, on a definition card, that answers one question for one audience: what is counted, how, from which source, by whom and how often.
Definition card	The one-page specification of a metric: the question it answers, the decision it informs, the formula, the source, the roles, the checks, the target or thresholds and the known limits.
Retire	To stop collecting and reporting a metric, keeping its card and the reason. A metric that informed no decision in the last 12 months is retired (MR-11).
KPI	Key performance indicator. A metric that shows whether a control or process is working as intended, judged against a target.
KRI	Key risk indicator. A metric that gives early warning that a risk in the risk register may be moving, judged against thresholds set from that risk's appetite and tolerance.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	The worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its self-check as at 30 Sep 2026, on the running programme, after its first 3 monthly cycles (July to September 2026), and its metric review at adoption on 26 Jun 2026. Results show it until you choose 'My answers'.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	The whole self-check: what is measured, how, and whether it gives valid results
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	Results: next actions and the metrics to drop and fix, identified from this evaluation
NIST CSF 2.0	GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed”	Dimensions MD-04 to MD-06: performance evaluated on figures that can be trusted, for the audience that decides
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	The whole self-check, as part of assessing how well the risk-management measures work
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them	Metric review: what is measured, how, when and by whom
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.3 — review and, where appropriate, update the policy and procedures at planned intervals and after significant incidents or significant changes to operations or risks	Repeating the self-check once a year and after significant change
DORA — Regulation (EU) 2022/2554	Article 13(4) — financial entities monitor the effectiveness of the implementation of their digital operational resilience strategy, and map the evolution of ICT risk over time, analysing the frequency, types, magnitude and evolution of ICT-related incidents	The whole self-check: monitoring how well the resilience strategy works

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA)