Operational Security Metrics Dashboard
Monthly operational view for the security and IT leadership team with trend, threshold and owner commentary.
Available soon
- Format
- Excel
- Size
- 118 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.1
MC-35 shows the ordering platform's monthly restore check (P10 EA-04): 0 of 4.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Metric Settings: one row per metric you report, from the Security KPI & KRI Catalogue. Choose the Metric ID; the name, type, owner, cadence and linked risk come from the catalogue on the Lists sheet. Enter the unit, whether higher or lower is better, and for a KPI its target and tolerance limit, for a KRI its amber and red thresholds from the Key Risk Indicator Threshold & Escalation Model (MR-07). A share is a number from 0 to 1. A quarterly metric shows only in the last month of each quarter, and its direction compares with the last quarter. |
| 2 | Monthly Values: after the checks in the Metrics Data Collection & Quality Workbook (5 working days after the month end), enter one row per metric for the month: the month's last day, the value, and 'Out of' for a share. Leave the value blank for a figure that was withheld, and say why in 'Value in words': it shows as Not available. Never copy last month's value forward (MR-05). |
| 3 | Use 'Figure the target judges' when the target judges a figure other than the value: 'none more than 30 days overdue' judges the actions more than 30 days overdue, and the on-plan rule for Tier 1 suppliers (MC-17) judges those assessed or booked before year end. Use 'Past tolerance' for a KRI whose red zone counts something else, as the risk position indicator (MC-13) does. |
| 4 | For a KRI whose linked risk has an approved treatment plan, the risk owner records each month whether the plan is on schedule: Yes or No in 'Treatment plan on schedule'. The treatment plan has at least one open action, and every open action is before its due date and not reported at risk by its owner. A KRI amber for 3 months in a row is escalated as red unless it says Yes (MR-08). |
| 5 | Dashboard: enter the report month (its last day) and the as-at date. Type both: never a formula that changes them. Status, zone, direction and escalation calculate. The metric owner writes the commentary on Monthly Values by 6 working days after the month end; the Check column says where commentary is still needed. |
| 6 | For a KRI in amber or red, record the escalation on KRI Escalations the day it starts: when the value was validated, when the first person was told and when the linked risk was reviewed. The sheet shows the deadlines MR-08 sets and whether each was met. MC-39 counts them one cycle in arrears: this month's dashboard reports last month's escalations, because a risk review can finish after this month's report goes out. |
| 7 | The security and IT leadership team reviews the dashboard 7 working days after the month end (Calendar sheet). Keep a copy of each month's workbook as the record. |
| 8 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column on Metric Settings, Monthly Values and KRI Escalations. Keep the catalogue on the Lists sheet. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule MR-12: "Every value must be shown with its target or thresholds, its direction since the last period and its status in words (P03 BR-04). Never colour alone, never a combined index, and never a score out of 100." Rule MR-08: "A KRI that enters amber or red must be escalated as the escalation table sets, counting from the date its value is validated. A KRI amber for [[3]] periods in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period. If the plan slips, the KRI is escalated as red."
Status words for a KPI: On target; Below target, within tolerance; Outside tolerance; No target set. Zone words for a KRI: Green: consistent with the risk within appetite; Amber: the risk may be above appetite; Red: the risk may be past tolerance. The zone never moves the linked risk: only its reassessment in the risk register does (P05).
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its September 2026 dashboard, as at the executive committee meeting on 14 Oct 2026, so the escalation record is complete. Phishing compromises (MC-34) moved from green in August to amber: two in three months. The owner of the linked risk was told the day the value was validated, and reviewed the risk within the 10 working days RM-10 allows. Risks outside appetite (MC-13) has been amber for 3 months, and is not escalated as red because both treatment plans are on schedule, as recorded this month (MR-08). MC-39 reads "None due": no KRI was escalated in August; September's escalation is counted in October. July and August values are shown where the example records them, and June's for a quarterly metric; the others show "No previous value".
Tailoring — small organisation: report the executive metrics and the key risk indicators only, and leave the rest to the owner's own tracking. Keep every value's target or thresholds, direction and status in words.
Tailoring — regulated entity (NIS2, DORA): the monthly dashboard shows that effectiveness is assessed and ICT risk is monitored over time (NIS2 Art 21(2)(f); DORA Art 13(4)). Keep each month's copy.
Tailoring — IT run by a service provider: the provider's own service report is an input, never the dashboard. Take its figures through the collection workbook's checks first.
Dashboard
Operational security metrics — monthly dashboard
For the security and IT leadership team. Yellow cells are yours; everything else is calculated from Metric Settings and Monthly Values. Every status is in words; the colour only repeats it (MR-12).
Report settings
| Setting | Value | |
|---|---|---|
| Month (its last day) | 30 Sep 2026 | EXAMPLE — the month the figures describe |
| As-at date (the day you read it) | 14 Oct 2026 | EXAMPLE — the executive committee meeting |
| Figures validated on | 7 Oct 2026 | |
| Leadership team review due (calc) | 9 Oct 2026 |
This month at a glance
| Status or zone | Metrics |
|---|---|
| Green: consistent with the risk within appetite | 2 |
| Amber: the risk may be above appetite | 2 |
| Red: the risk may be past tolerance | 0 |
| On target | 11 |
| Below target, within tolerance | 4 |
| Outside tolerance | 0 |
| No target set | 0 |
| Not available | 0 |
Key risk indicators outside green: 2. KPIs short of target: 4. Metrics with commentary still needed: 0.
KRI — key risk indicators
| Metric | Linked risk | Owner | Thresholds | 31 Jul 2026 | 31 Aug 2026 | This month | Direction | Status or zone | Escalation or check | Owner's commentary | Row |
|---|---|---|---|---|---|---|---|---|---|---|---|
| MC-13 Risks outside appetite and past tolerance | All top risks | Head of Information Security | Amber when any top risk is outside appetite, red when any is past tolerance. | 3 | 3 | 2 of 12 top risks outside appetite; 0 past tolerance | Better (was 3, last month) | Amber: the risk may be above appetite | Amber for 3 months; treatment plan on schedule, recorded: not escalated as red (MR-08) | R-01 and R-02 are outside appetite, both within tolerance. Amber for 3 months in a row; each treatment plan is on schedule, recorded by its owner on 7 Oct 2026 (MR-08): R-01: Treatment decision Reduce, approved by the Chief Operating Officer (RM-06). TA-01 due 15 Dec 2026, awaiting board approval: its funding goes to the board on 29 Oct 2026, as the plan sets. R-02: Treatment decision Reduce, approved by the Chief Financial Officer (RM-06). TA-02 due 30 Nov 2026, in progress. | 1 |
| MC-20 Concentration | R-06 | Head of Information Security | Amber at 8, red at 10 providers | — | — | 6 providers (SUP-001, SUP-002, SUP-004, SUP-006, SUP-011, SUP-014) | No previous value | Green: consistent with the risk within appetite | OK | Each carries two or more of the five critical services; the managed IT provider (SUP-001) carries three. | 6 |
| MC-34 Phishing compromises | R-09 | Head of Information Security | Amber at 2, red at 4 incidents in 3 months | 0 | 1 | 2 in 3 months (INC-2026-014, INC-2026-017) | Worse (was 1, last month) | Amber: the risk may be above appetite | Tell the owner of the linked risk within 5 working days of validation (MR-08) | ESC-2026-09-01: amber this month. The owner of R-09 (HR Director) was told on 7 Oct 2026 and reviewed the risk on 13 Oct 2026. Both compromises were found by the monitoring provider and contained within hours: INC-2026-017 in 40 minutes, with no mail taken. Likelihood stays at Likely, as long as the second-factor gap INC-2026-017 used is closed by 30 Nov 2026. Agreed at the executive committee on 14 Oct 2026: replace text-message codes with an authenticator app for every staff account that can sign in from outside the office (Head of IT, €4,500 a year). | 15 |
| MC-35 Critical systems without a checked restore | R-10 | Head of IT | Amber at 2, red at 3 critical systems | — | — | 0 of 4 | No previous value | Green: consistent with the risk within appetite | OK | Every critical system had a backup restored and checked in the last 3 months; the ordering platform's is checked each month (P10 EA-04). | 16 |
Zone: Green: consistent with the risk within appetite; Amber: the risk may be above appetite; Red: the risk may be past tolerance. Amber: tell the owner of the linked risk within 5 working days of validation (MR-08). Red: tell executive management, through the Head of Information Security, within 2 working days of validation (MR-08). Amber for 3 months in a row is escalated as red, unless its linked risk has an approved treatment plan that is on schedule (P05 RM-06, RM-07), recorded by the risk owner each period (MR-08).
KPI — performance against target
| Metric | Board measure | Owner | Target | 31 Jul 2026 | 31 Aug 2026 | This month | Direction | Status or zone | Escalation or check | Owner's commentary | Row |
|---|---|---|---|---|---|---|---|---|---|---|---|
| MC-14 Treatment actions overdue | Head of Information Security | Zero older than 30 days | — | — | 0 | No previous value | On target | OK | 2 | ||
| MC-15 Acceptances past review | Head of Information Security | Zero | — | — | 0 | No previous value | On target | OK | 3 | ||
| MC-17 Tier 1 suppliers assessed | BM-05 | Head of Information Security | All Tier 1 by [[year end]] | 7 | 8 | 9 of 14 | Better (was 8, last month) | On target | OK | The other 5 are booked for Q4 2026, so all 14 are on plan for year end. | 4 |
| MC-19 High findings past deadline | Head of Information Security | Zero | 1 | 1 | 1 (F-01, SUP-004, 72 days past) | Same (was 1, last month) | Below target, within tolerance | OK | F-01: support staff reach our ERP without multi-factor authentication. Escalated to the business owner under P06 TP-08. | 5 | |
| MC-22 Removals confirmed on time | Head of Information Security | ≥ [[95%]] | — | — | 65 of 69 (94%) | No previous value | Below target, within tolerance | OK | Three privileged removals waited on the ERP provider's 5-day ticket (P07 PW-02). | 7 | |
| MC-24 Process weaknesses open | Head of Information Security | Zero past their date | — | — | 0 past their date (2 open) | No previous value | On target | OK | 8 | ||
| MC-25 Significant incidents and time to contain | BM-04 | Head of Information Security | Each contained within [[24]] hours | — | — | 1 significant incident; contained in 6 hours | Same (was 1, last quarter) | On target | OK | 9 | |
| MC-26 Reports made on time | Head of Information Security | All | — | — | 4 of 4 | No previous value | On target | OK | 10 | ||
| MC-27 Review actions overdue | Head of Information Security | None more than 30 days overdue | — | — | 1 (PIA-04, 5 days) | No previous value | On target | OK | 11 | ||
| MC-28 Months since the plan was last exercised | Head of Information Security | 12 or fewer | — | — | 6 months (last exercise 18 Mar 2026) | No previous value | On target | OK | 12 | ||
| MC-29 Audiences exercised within their interval | Exercise lead | All four | — | — | 2 of 4 (AU-03 and AU-04 past their interval) | No previous value | Below target, within tolerance | OK | Both late audiences are exercised in October (P10). | 13 | |
| MC-31 Exercise actions overdue | Exercise lead | None more than 30 days overdue | — | — | 1 (EA-06, 3 days) | No previous value | On target | OK | 14 | ||
| MC-36 Staff security training completion | BM-08 | Head of Information Security | [[95%]] | — | — | 92% | No previous value | Below target, within tolerance | OK | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). | 17 |
| MC-38 Figures that failed a quality check | Head of Information Security | None reported with a caveat or withheld | — | — | 2 failed; 2 corrected, 0 reported with a caveat or withheld | No previous value | On target | OK | 18 | ||
| MC-39 KRI escalations made on time | Head of Information Security | All | — | — | None due: no KRI escalated in August 2026 | On target | OK | One cycle in arrears: no KRI was escalated in August 2026. ESC-2026-09-01, started in September, is counted in October's report. | 19 |
Status: On target; Below target, within tolerance; Outside tolerance; No target set. Direction is Better, Same or Worse than last month, or last quarter for a quarterly metric, with that figure. A quarterly metric shows in the last month of each quarter only.
KRI escalations (MR-08)
| MC-39 KRI escalations made on time (last month's) | None due | One cycle in arrears: escalations started last month in which the first person was told, and the linked risk reviewed, in time. Enter it on Monthly Values as MC-39. |
| Escalations started this month | 1 of 1 on time so far | Counted in next month's MC-39, once each linked risk's review is done. |
Metric Settings
One row per metric you report, from the Security KPI & KRI Catalogue. Yellow columns are yours; the rest calculate for the report month on the Dashboard. EXAMPLE rows: the example organisation's 19 metrics.
| Row | Metric ID | Metric (calc) | Type (calc) | Owner (calc) | Linked risk or board measure (calc) | Unit | Better when | Target | Tolerance limit | Amber at | Red at | Thresholds in words (KRI) | Target or thresholds (calc) | Cadence (calc) | Shown this month (calc) | Row this month (calc) | Row last month (calc) | Row two months ago (calc) | Row last quarter (calc) | This month (calc) | Last month (calc) | Two months ago (calc) | Last quarter (calc) | Judged on (calc) | Target used (calc) | Status or zone (calc) | Zone last month (calc) | Zone two months ago (calc) | Direction (calc) | Escalation (calc) | Value in words (calc) | Commentary (calc) | Check (calc) | KRI no. (calc) | KPI no. (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | MC-13 | Risks outside appetite and past tolerance | KRI | Head of Information Security | All top risks | Count | Lower | 1 | 1 | Amber when any top risk is outside appetite, red when any is past tolerance. | Amber when any top risk is outside appetite, red when any is past tolerance. | Monthly | Yes | 10 | 6 | 2 | 2.000 | 3.000 | 3.000 | 2.000 | Amber: the risk may be above appetite | Amber | Amber | Better (was 3, last month) | Amber for 3 months; treatment plan on schedule, recorded: not escalated as red (MR-08) | 2 of 12 top risks outside appetite; 0 past tolerance | R-01 and R-02 are outside appetite, both within tolerance. Amber for 3 months in a row; each treatment plan is on schedule, recorded by its owner on 7 Oct 2026 (MR-08): R-01: Treatment decision Reduce, approved by the Chief Operating Officer (RM-06). TA-01 due 15 Dec 2026, awaiting board approval: its funding goes to the board on 29 Oct 2026, as the plan sets. R-02: Treatment decision Reduce, approved by the Chief Financial Officer (RM-06). TA-02 due 30 Nov 2026, in progress. | OK | 1 | ||||||
| EXAMPLE | MC-14 | Treatment actions overdue | KPI | Head of Information Security | Count | Lower | 0.000 | 0.000 | Zero older than 30 days | Monthly | Yes | 11 | 0.000 | 0.000 | 0.000 | On target | No previous value | 0 | OK | 1 | |||||||||||||||
| EXAMPLE | MC-15 | Acceptances past review | KPI | Head of Information Security | Count | Lower | 0.000 | 0.000 | Zero | Monthly | Yes | 12 | 0.000 | 0.000 | 0.000 | On target | No previous value | 0 | OK | 2 | |||||||||||||||
| EXAMPLE | MC-17 | Tier 1 suppliers assessed | KPI | Head of Information Security | BM-05 | Count | Higher | 14.000 | 12.000 | All Tier 1 by [[year end]] | Monthly | Yes | 13 | 7 | 3 | 9.000 | 8.000 | 7.000 | 14.000 | 14.000 | On target | Better (was 8, last month) | 9 of 14 | The other 5 are booked for Q4 2026, so all 14 are on plan for year end. | OK | 3 | |||||||||
| EXAMPLE | MC-19 | High findings past deadline | KPI | Head of Information Security | Count | Lower | 0.000 | 1.000 | Zero | Monthly | Yes | 14 | 8 | 4 | 1.000 | 1.000 | 1.000 | 1.000 | 0.000 | Below target, within tolerance | Same (was 1, last month) | 1 (F-01, SUP-004, 72 days past) | F-01: support staff reach our ERP without multi-factor authentication. Escalated to the business owner under P06 TP-08. | OK | 4 | ||||||||||
| EXAMPLE | MC-20 | Concentration | KRI | Head of Information Security | R-06 | Count | Lower | 8 | 10 | Amber at 8, red at 10 providers | Amber at 8, red at 10 providers | Monthly | Yes | 15 | 6.000 | 6.000 | Green: consistent with the risk within appetite | No previous value | 6 providers (SUP-001, SUP-002, SUP-004, SUP-006, SUP-011, SUP-014) | Each carries two or more of the five critical services; the managed IT provider (SUP-001) carries three. | OK | 2 | |||||||||||||
| EXAMPLE | MC-22 | Removals confirmed on time | KPI | Head of Information Security | Share | Higher | 0.950 | 0.900 | ≥ [[95%]] | Monthly | Yes | 16 | 0.942 | 0.942 | 0.950 | Below target, within tolerance | No previous value | 65 of 69 (94%) | Three privileged removals waited on the ERP provider's 5-day ticket (P07 PW-02). | OK | 5 | ||||||||||||||
| EXAMPLE | MC-24 | Process weaknesses open | KPI | Head of Information Security | Count | Lower | 0.000 | 0.000 | Zero past their date | Monthly | Yes | 17 | 0.000 | 0.000 | 0.000 | On target | No previous value | 0 past their date (2 open) | OK | 6 | |||||||||||||||
| EXAMPLE | MC-25 | Significant incidents and time to contain | KPI | Head of Information Security | BM-04 | Count | Lower | 24.000 | 48.000 | Each contained within [[24]] hours | Quarterly | Yes | 18 | 1 | 1.000 | 1.000 | 6.000 | 24.000 | On target | Same (was 1, last quarter) | 1 significant incident; contained in 6 hours | OK | 7 | ||||||||||||
| EXAMPLE | MC-26 | Reports made on time | KPI | Head of Information Security | Share | Higher | 1.000 | 1.000 | All | Quarterly | Yes | 19 | 1.000 | 1.000 | 1.000 | On target | No previous value | 4 of 4 | OK | 8 | |||||||||||||||
| EXAMPLE | MC-27 | Review actions overdue | KPI | Head of Information Security | Count | Lower | 0.000 | 0.000 | None more than 30 days overdue | Monthly | Yes | 20 | 1.000 | 0.000 | 0.000 | On target | No previous value | 1 (PIA-04, 5 days) | OK | 9 | |||||||||||||||
| EXAMPLE | MC-28 | Months since the plan was last exercised | KPI | Head of Information Security | Months | Lower | 12.000 | 12.000 | 12 or fewer | Quarterly | Yes | 21 | 6.000 | 6.000 | 12.000 | On target | No previous value | 6 months (last exercise 18 Mar 2026) | OK | 10 | |||||||||||||||
| EXAMPLE | MC-29 | Audiences exercised within their interval | KPI | Exercise lead | Count | Higher | 4.000 | 2.000 | All four | Monthly | Yes | 22 | 2.000 | 2.000 | 4.000 | Below target, within tolerance | No previous value | 2 of 4 (AU-03 and AU-04 past their interval) | Both late audiences are exercised in October (P10). | OK | 11 | ||||||||||||||
| EXAMPLE | MC-31 | Exercise actions overdue | KPI | Exercise lead | Count | Lower | 0.000 | 0.000 | None more than 30 days overdue | Monthly | Yes | 23 | 1.000 | 0.000 | 0.000 | On target | No previous value | 1 (EA-06, 3 days) | OK | 12 | |||||||||||||||
| EXAMPLE | MC-34 | Phishing compromises | KRI | Head of Information Security | R-09 | Count | Lower | 2 | 4 | Amber at 2, red at 4 incidents in 3 months | Amber at 2, red at 4 incidents in 3 months | Monthly | Yes | 24 | 9 | 5 | 2.000 | 1.000 | 0.000 | 2.000 | Amber: the risk may be above appetite | Green | Green | Worse (was 1, last month) | Tell the owner of the linked risk within 5 working days of validation (MR-08) | 2 in 3 months (INC-2026-014, INC-2026-017) | ESC-2026-09-01: amber this month. The owner of R-09 (HR Director) was told on 7 Oct 2026 and reviewed the risk on 13 Oct 2026. Both compromises were found by the monitoring provider and contained within hours: INC-2026-017 in 40 minutes, with no mail taken. Likelihood stays at Likely, as long as the second-factor gap INC-2026-017 used is closed by 30 Nov 2026. Agreed at the executive committee on 14 Oct 2026: replace text-message codes with an authenticator app for every staff account that can sign in from outside the office (Head of IT, €4,500 a year). | OK | 3 | ||||||
| EXAMPLE | MC-35 | Critical systems without a checked restore | KRI | Head of IT | R-10 | Count | Lower | 2 | 3 | Amber at 2, red at 3 critical systems | Amber at 2, red at 3 critical systems | Monthly | Yes | 25 | 0.000 | 0.000 | Green: consistent with the risk within appetite | No previous value | 0 of 4 | Every critical system had a backup restored and checked in the last 3 months; the ordering platform's is checked each month (P10 EA-04). | OK | 4 | |||||||||||||
| EXAMPLE | MC-36 | Staff security training completion | KPI | Head of Information Security | BM-08 | Share | Higher | 0.950 | 0.850 | [[95%]] | Monthly | Yes | 26 | 0.920 | 0.920 | 0.950 | Below target, within tolerance | No previous value | 92% | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). | OK | 13 | |||||||||||||
| EXAMPLE | MC-38 | Figures that failed a quality check | KPI | Head of Information Security | Count | Lower | 0.000 | 1.000 | None reported with a caveat or withheld | Monthly | Yes | 27 | 2.000 | 0.000 | 0.000 | On target | No previous value | 2 failed; 2 corrected, 0 reported with a caveat or withheld | OK | 14 | |||||||||||||||
| EXAMPLE | MC-39 | KRI escalations made on time | KPI | Head of Information Security | Share | Higher | 1.000 | 1.000 | All | Monthly | Yes | 28 | 1.000 | On target | None due: no KRI escalated in August 2026 | One cycle in arrears: no KRI was escalated in August 2026. ESC-2026-09-01, started in September, is counted in October's report. | OK | 15 |
Monthly Values
One row per metric per month, from the Metrics Data Collection & Quality Workbook's results. Month end is the month's last day. EXAMPLE rows: September for every metric, July and August where the example records them, and June for a quarterly metric.
| Row | Month end | Metric ID | Metric (calc) | Value | Out of (for a share) | Figure the target judges | Past tolerance | Treatment plan on schedule (KRI) | Value in words | Owner's commentary | Key (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | 30 Jun 2026 | MC-25 | Significant incidents and time to contain | 1 | 1 | MC-25|46203 | |||||
| EXAMPLE | 31 Jul 2026 | MC-13 | Risks outside appetite and past tolerance | 3 | 0 | 3 of 12 top risks outside appetite; 0 past tolerance | MC-13|46234 | ||||
| EXAMPLE | 31 Jul 2026 | MC-17 | Tier 1 suppliers assessed | 7 | 7 of 14 | MC-17|46234 | |||||
| EXAMPLE | 31 Jul 2026 | MC-19 | High findings past deadline | 1 | 1 | MC-19|46234 | |||||
| EXAMPLE | 31 Jul 2026 | MC-34 | Phishing compromises | 0 | 0 in 3 months | MC-34|46234 | |||||
| EXAMPLE | 31 Aug 2026 | MC-13 | Risks outside appetite and past tolerance | 3 | 0 | 3 of 12 top risks outside appetite; 0 past tolerance | MC-13|46265 | ||||
| EXAMPLE | 31 Aug 2026 | MC-17 | Tier 1 suppliers assessed | 8 | 8 of 14 | MC-17|46265 | |||||
| EXAMPLE | 31 Aug 2026 | MC-19 | High findings past deadline | 1 | 1 | MC-19|46265 | |||||
| EXAMPLE | 31 Aug 2026 | MC-34 | Phishing compromises | 1 | 1 in 3 months | MC-34|46265 | |||||
| EXAMPLE | 30 Sep 2026 | MC-13 | Risks outside appetite and past tolerance | 2 | 0 | Yes | 2 of 12 top risks outside appetite; 0 past tolerance | R-01 and R-02 are outside appetite, both within tolerance. Amber for 3 months in a row; each treatment plan is on schedule, recorded by its owner on 7 Oct 2026 (MR-08): R-01: Treatment decision Reduce, approved by the Chief Operating Officer (RM-06). TA-01 due 15 Dec 2026, awaiting board approval: its funding goes to the board on 29 Oct 2026, as the plan sets. R-02: Treatment decision Reduce, approved by the Chief Financial Officer (RM-06). TA-02 due 30 Nov 2026, in progress. | MC-13|46295 | ||
| EXAMPLE | 30 Sep 2026 | MC-14 | Treatment actions overdue | 0 | 0 | 0 | MC-14|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-15 | Acceptances past review | 0 | 0 | MC-15|46295 | |||||
| EXAMPLE | 30 Sep 2026 | MC-17 | Tier 1 suppliers assessed | 9 | 14 | 9 of 14 | The other 5 are booked for Q4 2026, so all 14 are on plan for year end. | MC-17|46295 | |||
| EXAMPLE | 30 Sep 2026 | MC-19 | High findings past deadline | 1 | 1 (F-01, SUP-004, 72 days past) | F-01: support staff reach our ERP without multi-factor authentication. Escalated to the business owner under P06 TP-08. | MC-19|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-20 | Concentration | 6 | 6 providers (SUP-001, SUP-002, SUP-004, SUP-006, SUP-011, SUP-014) | Each carries two or more of the five critical services; the managed IT provider (SUP-001) carries three. | MC-20|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-22 | Removals confirmed on time | 65 | 69 | 65 of 69 (94%) | Three privileged removals waited on the ERP provider's 5-day ticket (P07 PW-02). | MC-22|46295 | |||
| EXAMPLE | 30 Sep 2026 | MC-24 | Process weaknesses open | 0 | 0 past their date (2 open) | MC-24|46295 | |||||
| EXAMPLE | 30 Sep 2026 | MC-25 | Significant incidents and time to contain | 1 | 6 | 1 significant incident; contained in 6 hours | MC-25|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-26 | Reports made on time | 4 | 4 | 4 of 4 | MC-26|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-27 | Review actions overdue | 1 | 0 | 1 (PIA-04, 5 days) | MC-27|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-28 | Months since the plan was last exercised | 6 | 6 months (last exercise 18 Mar 2026) | MC-28|46295 | |||||
| EXAMPLE | 30 Sep 2026 | MC-29 | Audiences exercised within their interval | 2 | 2 of 4 (AU-03 and AU-04 past their interval) | Both late audiences are exercised in October (P10). | MC-29|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-31 | Exercise actions overdue | 1 | 0 | 1 (EA-06, 3 days) | MC-31|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-34 | Phishing compromises | 2 | 2 in 3 months (INC-2026-014, INC-2026-017) | ESC-2026-09-01: amber this month. The owner of R-09 (HR Director) was told on 7 Oct 2026 and reviewed the risk on 13 Oct 2026. Both compromises were found by the monitoring provider and contained within hours: INC-2026-017 in 40 minutes, with no mail taken. Likelihood stays at Likely, as long as the second-factor gap INC-2026-017 used is closed by 30 Nov 2026. Agreed at the executive committee on 14 Oct 2026: replace text-message codes with an authenticator app for every staff account that can sign in from outside the office (Head of IT, €4,500 a year). | MC-34|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-35 | Critical systems without a checked restore | 0 | 0 of 4 | Every critical system had a backup restored and checked in the last 3 months; the ordering platform's is checked each month (P10 EA-04). | MC-35|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-36 | Staff security training completion | 0.92 | 92% | Warehouse shift staff completed the short course on the floor terminals. The staff still to complete work night shifts: run the course on each warehouse night shift, HR Learning Lead, by 30 Nov 2026, to reach 95%. Not comparable with the June figure: the definition changed on 26 Jun 2026 (MR-09). | MC-36|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-38 | Figures that failed a quality check | 2 | 0 | 2 failed; 2 corrected, 0 reported with a caveat or withheld | MC-38|46295 | ||||
| EXAMPLE | 30 Sep 2026 | MC-39 | KRI escalations made on time | 0 | 0 | None due: no KRI escalated in August 2026 | One cycle in arrears: no KRI was escalated in August 2026. ESC-2026-09-01, started in September, is counted in October's report. | MC-39|46295 |
KRI Escalations
One row per KRI escalation (MR-08). Counting starts when the value is validated. Amber: tell the owner of the linked risk within 5 working days of validation (MR-08); red: tell executive management, through the Head of Information Security, within 2 working days of validation (MR-08). The linked risk is reviewed within 10 working days (P05 RM-10).
| Row | Escalation ID | Metric ID | Metric (calc) | Month end | Zone | Value | Linked risk | Risk owner | Validated on | Tell by (calc) | Told on | Risk review by (calc) | Risk reviewed on | Review result | Executive committee | Committee decision | Action, owner and due date | Told in time (calc) | Reviewed in time (calc) | On time, MR-08 (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | ESC-2026-09-01 | MC-34 | Phishing compromises | 30 Sep 2026 | Amber | 2 | R-09 | HR Director | 7 Oct 2026 | 14 Oct 2026 | 7 Oct 2026 | 21 Oct 2026 | 13 Oct 2026 | Residual kept at likelihood 2 × impact 3. Both compromises were found by the monitoring provider and contained within hours: INC-2026-017 in 40 minutes, with no mail taken. Likelihood stays at Likely, as long as the second-factor gap INC-2026-017 used is closed by 30 Nov 2026. | 14 Oct 2026 | Noted the amber KRI and the owner's review. Agreed the action below, and that the KRI is reported monthly until it returns to green. | Replace text-message codes with an authenticator app for every staff account that can sign in from outside the office. Head of IT, by 30 Nov 2026. | Yes | Yes | Yes |
Calendar
Calendar — the monthly cycle
The steps of the monthly cycle in working days after the month end, from the Security Metric Definition & Measurement Method, dated from the month on the Dashboard. Enter your public holidays so they are skipped.
| Step | Who | Working days after month end | Due date (calc) | Completed on | Status (calc) |
|---|---|---|---|---|---|
| Inputs supplied in the collection workbook, each with its extract date | Data supplier | 3 | 5 Oct 2026 | 5 Oct 2026 | Done |
| Quality checks run; each input accepted, corrected or rejected (MR-05, MR-06) | Validator | 5 | 7 Oct 2026 | 7 Oct 2026 | Done |
| KRI zones and KPI statuses set; commentary written; escalations started (MR-08) | Metric owner | 6 | 8 Oct 2026 | 8 Oct 2026 | Done |
| Operational dashboard reviewed by the security and IT leadership team | Reporter | 7 | 9 Oct 2026 | 9 Oct 2026 | Done |
| Executive committee report sent | Reporter | 8 | 12 Oct 2026 | 12 Oct 2026 | Done |
| Executive committee meeting | Reporter | 10 | 14 Oct 2026 | 14 Oct 2026 | Done |
Non-working days (public holidays)
| Date | Holiday |
|---|
[[e.g. a public holiday in the first two weeks of the month]]
Lists
| CatID | CatName | CatType | CatOwner | CatRisk | CatFeeds | CatTarget | CatCadence | Unit | Better | Zone | YesNo |
|---|---|---|---|---|---|---|---|---|---|---|---|
| MC-01 | Scan coverage | KPI | Standard owner | ≥ 95% (VM-02) | Monthly | Count | Higher | Green | Yes | ||
| MC-02 | Mean time to remediate, by priority | KPI | Standard owner | Below each priority's deadline | Monthly | Share | Lower | Amber | No | ||
| MC-03 | Deadline adherence | KPI | Standard owner | BM-02 | [[Target, e.g. ≥ 90%]] | Monthly | Days | Red | |||
| MC-04 | Overdue exposure | KRI | Standard owner | R-05 | Zero Priority 1; trend down for the rest | Monthly | Months | ||||
| MC-05 | Open exceptions by band | KPI | Head of Information Security | Trend down; no unexplained rise in High or Critical | Monthly | ||||||
| MC-06 | Expired exceptions | KPI | Head of Information Security | BM-03 | Zero High or Critical; below 5% overall | Monthly | |||||
| MC-07 | Chronic exceptions | KPI | Head of Information Security | Zero; each one reported by name | Monthly | ||||||
| MC-08 | Unmitigated SoD conflicts | KRI | Head of Information Security | R-02 | Zero | Monthly | |||||
| MC-09 | Documents past review date | KPI | Head of Information Security | Zero policies; no document more than 30 days overdue | Monthly | ||||||
| MC-10 | Documents in force without approval | KPI | Head of Information Security | Zero | Monthly | ||||||
| MC-11 | Acknowledgement coverage | KPI | Head of Information Security | ≥ 95% | Monthly | ||||||
| MC-12 | Overdue acknowledgements | KPI | Head of Information Security | Zero older than 30 days | Monthly | ||||||
| MC-13 | Risks outside appetite and past tolerance | KRI | Head of Information Security | All top risks | BM-01 | Zero past tolerance; outside appetite each with a treatment decision | Monthly | ||||
| MC-14 | Treatment actions overdue | KPI | Head of Information Security | Zero older than 30 days | Monthly | ||||||
| MC-15 | Acceptances past review | KPI | Head of Information Security | Zero | Monthly | ||||||
| MC-16 | Risks not reviewed this quarter | KPI | Head of Information Security | Zero | Monthly | ||||||
| MC-17 | Tier 1 suppliers assessed | KPI | Head of Information Security | BM-05 | All Tier 1 by [[year end]] | Monthly | |||||
| MC-18 | Reassessments overdue | KPI | Head of Information Security | Zero Tier 1; none more than 90 days overdue | Monthly | ||||||
| MC-19 | High findings past deadline | KPI | Head of Information Security | Zero | Monthly | ||||||
| MC-20 | Concentration | KRI | Head of Information Security | R-06 | Each one known, with an exit plan (TP-11) | Monthly | |||||
| MC-21 | Reviews on time | KPI | Head of Information Security | All | Monthly | ||||||
| MC-22 | Removals confirmed on time | KPI | Head of Information Security | ≥ [[95%]] | Monthly | ||||||
| MC-23 | Access that should not have existed | KRI | Head of Information Security | R-07 | Falling campaign on campaign | Monthly | |||||
| MC-24 | Process weaknesses open | KPI | Head of Information Security | Zero past their date | Monthly | ||||||
| MC-25 | Significant incidents and time to contain | KPI | Head of Information Security | BM-04 | Each contained within [[24]] hours | Quarterly | |||||
| MC-26 | Reports made on time | KPI | Head of Information Security | All | Quarterly | ||||||
| MC-27 | Review actions overdue | KPI | Head of Information Security | None more than 30 days overdue | Monthly | ||||||
| MC-28 | Months since the plan was last exercised | KPI | Head of Information Security | 12 or fewer | Quarterly | ||||||
| MC-29 | Audiences exercised within their interval | KPI | Exercise lead | All four | Monthly | ||||||
| MC-30 | Objectives met at the last exercise | KPI | Exercise lead | No category Not met at two exercises in a row (COMPARISON_RULE) | Monthly | ||||||
| MC-31 | Exercise actions overdue | KPI | Exercise lead | None more than 30 days overdue | Monthly | ||||||
| MC-32 | Re-tests outstanding | KPI | Exercise lead | None past the window | Monthly | ||||||
| MC-33 | Critical suppliers exercised | KPI | Exercise lead | All, by [[year end]] | Monthly | ||||||
| MC-34 | Phishing compromises | KRI | Head of Information Security | R-09 | Monthly | ||||||
| MC-35 | Critical systems without a checked restore | KRI | Head of IT | R-10 | BM-06 | Monthly | |||||
| MC-36 | Staff security training completion | KPI | Head of Information Security | BM-08 | [[95%]] | Monthly | |||||
| MC-37 | Metrics reported with an approved card | KPI | Head of Information Security | All | Monthly | ||||||
| MC-38 | Figures that failed a quality check | KPI | Head of Information Security | None reported with a caveat or withheld | Monthly | ||||||
| MC-39 | KRI escalations made on time | KPI | Head of Information Security | All | Monthly | ||||||
| MC-40 | Metrics reviewed in the last 12 months | KPI | Head of Information Security | All | Monthly |
Columns A to H are the Security KPI & KRI Catalogue: MC-01 to MC-40, with the owner who interprets each, the risk a KRI indicates, the board measure it feeds and its cadence. Yellow rows: add your own.
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Metric | A number defined once, on a definition card, that answers one question for one audience: what is counted, how, from which source, by whom and how often. |
| KPI | Key performance indicator. A metric that shows whether a control or process is working as intended, judged against a target. |
| KRI | Key risk indicator. A metric that gives early warning that a risk in the risk register may be moving, judged against thresholds set from that risk's appetite and tolerance. |
| Target | The value of a KPI the organisation is aiming for. A KPI at or better than its target is On target. |
| Tolerance limit | For a KPI: The limit beyond which the people who set it must act, and not just be told. For a risk, the highest residual band tolerated while a plan brings it back (P05). For a KPI, the furthest short of target the audience accepts without a decision (P03). |
| Threshold | A value of a KRI at which its zone changes: green to amber, or amber to red. |
| Zone | Where a KRI's value falls: green, amber or red. The zone says what the value suggests about the linked risk. It never changes the risk's position on its own: only a reassessment in the risk register does that (P05). |
| Zone — Green | Green: consistent with the risk within appetite. The indicator is where the risk owner expects it while the linked risk is within appetite. |
| Zone — Amber | Amber: the risk may be above appetite. The indicator is at a level at which the linked risk may have moved above appetite. The risk owner reviews it. |
| Zone — Red | Red: the risk may be past tolerance. The indicator is at a level at which the linked risk may have moved past tolerance. Executive management is told and the risk is reassessed. |
| Status — On target | At or better than the target used this month. |
| Status — Below target, within tolerance | Short of the target but inside the tolerance limit. The owner's commentary gives the plan and date. |
| Status — Outside tolerance | Beyond the tolerance limit, or short of target where no tolerance limit is set. The owner's commentary says what is decided. |
| Status — No target set | No target on Metric Settings. A KPI needs one before it is reported (MR-07). |
| Not available | No value for the month: withheld after a failed check, or not entered. Last month's value is never carried forward (MR-05). |
| Direction | Better, Same or Worse than last month (last quarter for a quarterly metric), read with 'Better when', with that figure and its period in brackets. 'No previous value' when there is none. |
| Cadence | Monthly, or quarterly where the owning pack defines the measure over a quarter. A quarterly metric shows in the last month of each quarter only. |
| Figure the target judges | The figure a target judges when it is not the value itself: actions more than 30 days overdue out of all overdue actions, or, under the on-plan rule for MC-17, Tier 1 suppliers assessed or booked before year end. |
| Past tolerance | For a KRI whose red zone counts something other than its value: for the risk position indicator (MC-13), the top risks past their tolerance. |
| Treatment plan on schedule | For a KRI, the risk owner's record for the month (MR-08). The treatment plan has at least one open action, and every open action is before its due date and not reported at risk by its owner. An open action passes its due date or is reported at risk, or the plan's funding or approval is refused. The KRI is then escalated as red in that period. |
| Escalation | What MR-08 requires for a KRI in amber or red, counted in working days from validation. The linked risk is reassessed within 10 working days of validation (P05 RM-10). If the reassessment puts it past tolerance, the board or its equivalent is told within 5 working days, out of cycle (P03), and only the board or its equivalent may accept it (P05). |
| Leading and lagging | An indicator that moves before harm is done, such as weaknesses past their fix deadline. An indicator that moves only after harm is done, such as incidents. Useful, but on its own too late to warn. |
| Break in series | The point where a metric's definition, source or thresholds changed. No trend is drawn across it unless earlier values are restated. |
| Metric owner | The person who interprets a metric, writes the commentary and answers for it. One per metric. |
| MR-nn, MC-nn, BM-nn | Rules and metrics in the Security Metric Definition & Measurement Method and the Security KPI & KRI Catalogue; board measures in the board reporting pack (P03). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is monitored and measured, when, and the results analysed and evaluated each month |
| NIST CSF 2.0 | ID.IM-03 — “Improvements are identified from execution of operational processes, procedures, and activities” | Status, direction and commentary: improvements found from running the controls month by month |
| NIST CSF 2.0 | GV.RM-02 — “Risk appetite and risk tolerance statements are established, communicated, and maintained” | Metric Settings: KRI thresholds set from the linked risk's appetite and tolerance |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | The monthly assessment of whether the risk-management measures are effective |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them | Monthly Values and Calendar: what is measured, when, and when the results are analysed and by whom |
| DORA — Regulation (EU) 2022/2554 | Article 13(4) — financial entities monitor the effectiveness of the implementation of their digital operational resilience strategy, and map the evolution of ICT risk over time, analysing the frequency, types, magnitude and evolution of ICT-related incidents | Trend and direction: ICT risk and the effectiveness of measures monitored over time (financial entities) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA)