Security KPI & KRI Catalogue

Operational and risk indicators with definitions, sources, thresholds and owners; extends the board catalogue in P03 without duplicating it.

Available soon

Format: Excel
Size: 78 KB
Length: 11 sheets
Version: 1.0
Updated: 29 Sep 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.029 Sep 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Read the KPI & KRI Catalogue. Each row is one metric with a stable ID (MC-01 to MC-40). Where another pack already defines the measure, the row uses that pack's name, definition and target unchanged (MR-04): "Where another pack already defines a measure, the catalogue must use that definition and target unchanged. A change is made in the pack that owns it, never in the catalogue." Rows owned by this pack (P11) fill gaps no other pack covers.
2	Filter on Type, Theme, Owning pack or Audience. A KPI shows whether a control works, against a target. A KRI warns that a risk in your risk register may be moving, against thresholds set from that risk's appetite and tolerance (MR-07).
3	The Board measure column names the Board Cybersecurity Reporting measure (BM-01 to BM-08) the metric feeds. The board measures stay in that pack: this catalogue feeds them and never copies them.
4	On KRI Thresholds, enter for each KRI the category, appetite level and residual impact and likelihood of the risk it indicates, from your risk register. The sheet gives the risk's position now and the zone the KRI starts in.
5	With the risk owner, set the amber and red thresholds by the method in the Key Risk Indicator Threshold & Escalation Model: for each, record the impact and likelihood the owner would score at that value. The check says OK when amber stands for a score outside appetite, within tolerance and red for one outside tolerance. The risk owner approves them.
6	On Choose Yours, delete the EXAMPLE rows, then pick your metrics by Metric ID. The metric, type, owning pack, board measure, audience and target fill in. For each KPI set the tolerance: the furthest short of target the audience accepts without a decision.
7	Name the data supplier, the validator and the metric owner for each chosen metric, as posts. The supplier and the validator must be different people (MR-06). Clear every Check that does not say OK.
8	Read the Selection Check. When it says Ready, write a definition card for each chosen metric on the Metric Definition Card Template before its first value is reported (MR-02), and put the four roles into the Metric Ownership Responsibility Matrix.
9	Review the selection once a year against the metric review questions in the Metrics Programme Maturity Self-Check (MR-11). Retire a metric that informed no decision, and keep its row with the reason.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Owning packs: P01 Vulnerability & Exposure Management; P02 Security Exception, Waiver & Segregation of Duties; P04 Security Policy Management; P05 Information Security Risk Management; P06 Third-Party Security Risk Management; P07 User Access Review; P09 Security Incident Management; P10 Cyber Incident Exercises & Tabletop Scenario Library; P11 Cybersecurity Metrics & Reporting Programme. Left out: P08's certification readiness measures (ISM-01 to ISM-04), which end with the project; P03's board measures, which the catalogue feeds and never copies.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. It chose the 19 metrics it reported for September 2026. It does not run the Vulnerability & Exposure Management, Security Exception, Waiver & Segregation of Duties or Security Policy Management packs in this example, so its board takes BM-02 and BM-03 from the board report's own sources.

The catalogue rows are the template's content, not examples: keep, change or remove them as you tailor it. Only the rows on Choose Yours marked EXAMPLE are to be deleted. The linked risks on the catalogue are the EXAMPLE register's: replace them with your own.

Tailoring — small organisation: start with the KRI for risks outside appetite (MC-13), the KPIs that feed the board measures you report, and two or three KRIs for your largest risks. Twelve metrics run well are worth more than forty run badly.

Tailoring — regulated entity (NIS2, DORA): keep the incident, reporting and exercise metrics (MC-25 to MC-31). DORA asks the strategy to set key performance indicators and key risk metrics (Art 6(8)(c)) and to show the number of major ICT-related incidents and how well preventive measures work (Art 6(8)(f)).

Tailoring — IT run by a service provider: much of the data comes from the provider. Make each input a reporting obligation in the contract, with the definition from this catalogue, and keep the validator and the metric owner inside your organisation.

Colour in the Type, zone and Check columns only repeats the words beside it (MR-12).

KPI & KRI Catalogue

40 metrics by owning pack: 33 from other packs, used unchanged (MR-04), then 7 of this pack's own. Add your own on the blank rows with a new ID.

Metric ID	Metric	Type	Theme	Owning pack	ID in the owning pack	Definition — the owning pack's words (MR-04)	Target (KPI)	Linked risk (KRI)	Board measure it feeds (P03)	Leading or lagging	Audience	Cadence	Data supplier	Validator	Metric owner	Reporter	Note	Unit	Better when
MC-01	Scan coverage	KPI	Vulnerabilities and exposure	P01	Scan coverage	In-scope systems successfully scanned in the period ÷ in-scope systems.	≥ 95% (VM-02)	—	—	Leading	Operational	Monthly	IT Operations Manager	Information Security Manager	Standard owner	[[e.g. Information Security Manager]]	—	Share	Higher
MC-02	Mean time to remediate, by priority	KPI	Vulnerabilities and exposure	P01	Mean time to remediate, by priority	Average calendar days from first detection to verified closure, for findings closed in the period.	Below each priority's deadline	—	—	Lagging	Operational	Monthly	IT Operations Manager	Information Security Manager	Standard owner	[[e.g. Information Security Manager]]	—	Days	Lower
MC-03	Deadline adherence	KPI	Vulnerabilities and exposure	P01	Deadline adherence	Findings closed in the period within their deadline ÷ findings closed in the period.	[[Target, e.g. ≥ 90%]]	—	BM-02 Critical exposure fixed on time	Leading	Operational and executive	Monthly	IT Operations Manager	Information Security Manager	Standard owner	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	BM-02 reports the same count for Priority 1 and 2 only (P03).	Share	Higher
MC-04	Overdue exposure	KRI	Vulnerabilities and exposure	P01	Overdue exposure	Open findings past their deadline with no approved exception, by priority, with the age of the oldest.	Zero Priority 1; trend down for the rest	R-05 Critical weaknesses on internet-facing systems exploited before they are fixed (EXAMPLE register)	—	Leading	Operational and executive	Monthly	IT Operations Manager	Information Security Manager	Standard owner	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-05	Open exceptions by band	KPI	Accepted risk	P02	Open exceptions by band	Live approved exceptions at month end, by Low, Medium, High and Critical.	Trend down; no unexplained rise in High or Critical	—	—	Leading	Operational	Monthly	Control owner	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-06	Expired exceptions	KPI	Accepted risk	P02	Expired exceptions	Exceptions past their expiry date that are neither closed nor renewed, as a share of all open exceptions.	Zero High or Critical; below 5% overall	—	BM-03 Expired or high-risk exceptions	Leading	Operational and executive	Monthly	Control owner	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Share	Lower
MC-07	Chronic exceptions	KPI	Accepted risk	P02	Chronic exceptions	Exceptions renewed more than their band allows (EX-08), so the gap has outlived every renewal the Standard permits.	Zero; each one reported by name	—	—	Leading	Operational	Monthly	Control owner	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-08	Unmitigated SoD conflicts	KRI	Identity and access	P02	Unmitigated SoD conflicts	Known High conflicts with no compensating control recorded and reviewed in the last quarter.	Zero	R-02 Payment fraud through a compromised supplier email account (EXAMPLE register)	—	Leading	Operational and executive	Monthly	Control owner	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-09	Documents past review date	KPI	Assurance and compliance	P04	PM-01	Approved documents whose next review date has passed.	Zero policies; no document more than 30 days overdue	—	—	Leading	Operational	Monthly	Policy Coordinator	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-10	Documents in force without approval	KPI	Assurance and compliance	P04	PM-02	Documents people are told to follow that have no recorded approval at the right level.	Zero	—	—	Leading	Operational	Monthly	Policy Coordinator	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-11	Acknowledgement coverage	KPI	People and behaviour	P04	PM-03	People in scope with a current acknowledgement of each policy that applies to them, as a share of all people in scope.	≥ 95%	—	—	Leading	Operational	Monthly	HR Manager	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Share	Higher
MC-12	Overdue acknowledgements	KPI	People and behaviour	P04	PM-04	People past their joiner, change or annual deadline, named by manager.	Zero older than 30 days	—	—	Leading	Operational	Monthly	HR Manager	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-13	Risks outside appetite and past tolerance	KRI	Risk and appetite	P05	RMM-01	Top risks whose residual band is above their category's appetite; and of those, above its tolerance.	Zero past tolerance; outside appetite each with a treatment decision	All top risks	BM-01 Risks outside appetite	Lagging	Operational and executive	Monthly	Assessor	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	Its zones are the P03 positions themselves: amber when any top risk is outside appetite, red when any is past tolerance.	Count	Lower
MC-14	Treatment actions overdue	KPI	Risk and appetite	P05	RMM-02	Open treatment actions past their due date.	Zero older than 30 days	—	—	Leading	Operational and executive	Monthly	Head of Risk	Assessor	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-15	Acceptances past review	KPI	Accepted risk	P05	RMM-03	Accepted risks whose acceptance review date has passed.	Zero	—	—	Leading	Operational and executive	Monthly	Assessor	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-16	Risks not reviewed this quarter	KPI	Risk and appetite	P05	RMM-04	Register entries with no owner review in the last quarter (RM-09).	Zero	—	—	Leading	Operational	Monthly	Assessor	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-17	Tier 1 suppliers assessed	KPI	Suppliers	P06	TPM-01	Tier 1 suppliers with an assessment within the last 12 months, out of all Tier 1 suppliers.	All Tier 1 by [[year end]]	—	BM-05 Critical suppliers assessed	Leading	Operational and executive	Monthly	Procurement Manager	Assessor	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Higher
MC-18	Reassessments overdue	KPI	Suppliers	P06	TPM-02	Suppliers past their tier's reassessment interval.	Zero Tier 1; none more than 90 days overdue	—	—	Leading	Operational	Monthly	Procurement Manager	Assessor	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-19	High findings past deadline	KPI	Suppliers	P06	TPM-03	Open High findings past their remediation deadline.	Zero	—	—	Leading	Operational and executive	Monthly	Assessor	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-20	Concentration	KRI	Suppliers	P06	TPM-04	Providers that two or more critical services depend on.	Each one known, with an exit plan (TP-11)	R-06 Managed IT provider fails or is compromised (EXAMPLE register)	—	Leading	Operational and executive	Monthly	Procurement Manager	Assessor	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-21	Reviews on time	KPI	Identity and access	P07	ARM-01	In-scope systems reviewed within their frequency, out of all in-scope systems.	All	—	—	Leading	Operational	Monthly	Campaign coordinator	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	—	Share	Higher
MC-22	Removals confirmed on time	KPI	Identity and access	P07	ARM-02	Revoke and Modify decisions confirmed removed within their window, out of all such decisions.	≥ [[95%]]	—	—	Leading	Operational and executive	Monthly	System administrator	Campaign coordinator	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Share	Higher
MC-23	Access that should not have existed	KRI	Identity and access	P07	ARM-03	Leaver, dormant and orphan accounts found in the campaign.	Falling campaign on campaign	R-07 Administrator misuses privileged access (EXAMPLE register)	—	Leading	Operational	Monthly	Campaign coordinator	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-24	Process weaknesses open	KPI	Identity and access	P07	ARM-04	Findings sent to a process owner (AR-11) not yet fixed.	Zero past their date	—	—	Leading	Operational	Monthly	Campaign coordinator	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	—	Count	Lower
MC-25	Significant incidents and time to contain	KPI	Incidents and detection	P09	IMM-01	Incidents reported to an authority as significant (NIS2) or major (DORA) in the quarter, and for each the hours from detection to containment.	Each contained within [[24]] hours	—	BM-04 Significant incidents and time to contain	Lagging	Operational and executive	Quarterly	Incident manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	Quarterly, as P09 defines it: reported in the last month of each quarter.	Count	Lower
MC-26	Reports made on time	KPI	Incidents and detection	P09	IMM-02	Reports to authorities and individuals made by their deadline, out of all that fell due in the quarter.	All	—	—	Lagging	Operational and executive	Quarterly	Incident manager	Data Protection Officer	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	Quarterly, as P09 defines it: reported in the last month of each quarter.	Share	Higher
MC-27	Review actions overdue	KPI	Incidents and detection	P09	IMM-03	Open post-incident review actions past their due date.	None more than 30 days overdue	—	—	Leading	Operational and executive	Monthly	Incident manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-28	Months since the plan was last exercised	KPI	Resilience and recovery	P09	IMM-04	Whole months from the last exercise of the plan (not a live incident) to the end of the quarter.	12 or fewer	—	—	Leading	Operational and executive	Quarterly	Incident manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	Quarterly, as P09 defines it: reported in the last month of each quarter.	Months	Lower
MC-29	Audiences exercised within their interval	KPI	Resilience and recovery	P10	EXM-01	Audiences AU-01 to AU-04 whose last exercise (not a live incident) is within the interval the audience table sets, out of four.	All four	—	—	Leading	Operational and executive	Monthly	Exercise lead	Exercise sponsor	Exercise lead	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Higher
MC-30	Objectives met at the last exercise	KPI	Resilience and recovery	P10	EXM-02	At the latest exercise of the executive and crisis team: objectives Met, Partly met and Not met, out of those tested, with Not tested on its own line.	No category Not met at two exercises in a row (COMPARISON_RULE)	—	—	Leading	Operational	Monthly	Exercise lead	Exercise sponsor	Exercise lead	[[e.g. Information Security Manager]]	—	Count	Lower
MC-31	Exercise actions overdue	KPI	Resilience and recovery	P10	EXM-03	Open improvement actions from exercises past their due date.	None more than 30 days overdue	—	—	Leading	Operational and executive	Monthly	Exercise lead	Exercise sponsor	Exercise lead	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	—	Count	Lower
MC-32	Re-tests outstanding	KPI	Resilience and recovery	P10	EXM-04	Objectives rated Partly met or Not met whose action is done and whose re-test has not yet happened; and of those, how many are past the re-test window (EX-11).	None past the window	—	—	Leading	Operational	Monthly	Exercise lead	Exercise sponsor	Exercise lead	[[e.g. Information Security Manager]]	—	Count	Lower
MC-33	Critical suppliers exercised	KPI	Suppliers	P10	EXM-05	Suppliers the incident response plan names, that took part in an exercise in the last 12 months, out of all of them.	All, by [[year end]]	—	—	Leading	Operational	Monthly	Exercise lead	Exercise sponsor	Exercise lead	[[e.g. Information Security Manager]]	—	Count	Higher
MC-34	Phishing compromises	KRI	People and behaviour	P11	—	Incidents in the last 3 calendar months whose root cause was a phishing email: an account taken over, or malware run from an attachment or link. Counted from the incident case log by the date detected.	— (KRI: see KRI Thresholds)	R-09 Staff account taken over through phishing (EXAMPLE register)	—	Leading	Operational and executive	Monthly	Incident manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	This pack's own: no other pack defines it.	Count	Lower
MC-35	Critical systems without a checked restore	KRI	Resilience and recovery	P11	—	Systems that support a critical service with no backup restored and checked for integrity in the last [[3]] months, out of all such systems.	— (KRI: see KRI Thresholds)	R-10 Backups cannot restore a critical system (EXAMPLE register)	BM-06 Critical services restored in tests	Leading	Operational and executive	Monthly	IT Operations Manager	Information Security Manager	Head of IT	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	This pack's own: no other pack defines it.	Count	Lower
MC-36	Staff security training completion	KPI	People and behaviour	P11	—	Staff in post at the period end who have completed the security training due for their role in the last 12 months, as a share of all staff in post.	[[95%]]	—	BM-08 Board and staff security training	Leading	Operational and executive	Monthly	HR Learning Lead	Information Security Manager	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	This pack's own: no other pack defines it.	Share	Higher
MC-37	Metrics reported with an approved card	KPI	Metrics programme	P11	—	Metrics reported this period that had an approved definition card before their first value was reported (MR-02), out of all metrics reported.	All	—	—	—	Operational	Monthly	Information Security Manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	This pack's own: no other pack defines it.	Share	Higher
MC-38	Figures that failed a quality check	KPI	Metrics programme	P11	—	Figures this period that failed a completeness, freshness or plausibility check, split by outcome: corrected, reported with a caveat, withheld (MR-05).	None reported with a caveat or withheld	—	—	—	Operational and executive	Monthly	Derived from the Quality Log of the collection workbook, kept by the Information Security Manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	This pack's own: no other pack defines it. Derived: not supplied, so it is not collected or checked for freshness in the collection workbook.	Count	Lower
MC-39	KRI escalations made on time	KPI	Metrics programme	P11	—	Escalations of KRIs in amber or red started in the month before the period in which the first person was told, and the linked risk reviewed, within the times the escalation table sets (MR-08), out of all such escalations. Reported one cycle in arrears, because the risk review can fall after the month's report is sent.	All	—	—	—	Operational and executive	Monthly	Derived from the escalation log, kept by the Information Security Manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]; [[e.g. Head of Information Security]]	This pack's own: no other pack defines it. Derived: not supplied, so it is not collected or checked for freshness in the collection workbook. Reported one cycle in arrears.	Share	Higher
MC-40	Metrics reviewed in the last 12 months	KPI	Metrics programme	P11	—	Catalogue metrics in use whose card was reviewed against the metric review questions in the last 12 months (MR-11), out of all metrics in use.	All	—	—	—	Operational	Monthly	Information Security Manager	Head of Information Security	Head of Information Security	[[e.g. Information Security Manager]]	This pack's own: no other pack defines it.	Share	Higher

KRI Thresholds

Each KRI's thresholds, set from the appetite and tolerance of the risk it indicates (MR-07). Residual scores and appetite levels are the EXAMPLE register's: enter your own.

Metric ID	KRI (calc)	Linked risk	Risk owner	Risk category	Category appetite level	Appetite band (calc)	Tolerance band (calc)	Residual impact (1–4)	Residual likelihood (1–4)	Residual score (calc)	Residual band (calc)	Position now (calc)	Zone the KRI starts in (calc)	Amber threshold	Amber stands for: impact	Amber stands for: likelihood	Amber position (calc)	Red threshold	Red stands for: impact	Red stands for: likelihood	Red position (calc)	Threshold check (calc)	Reasoning	Approved by the risk owner (name, date)	Chosen (calc)
MC-04	Overdue exposure	R-05 Critical weaknesses on internet-facing systems exploited before they are fixed	Head of IT	RC-01 Service availability	Cautious	Medium	High	3	2	6	Medium	Within appetite	Green	[[Set with the Head of IT]]				[[Set with the Head of IT]]				Set the thresholds with the risk owner (MR-07)	[[Ask the risk owner at what value of this indicator they would score the likelihood one step higher, and at what value the impact as well (A08).]]	[[Name, date]]	No
MC-08	Unmitigated SoD conflicts	R-02 Payment fraud through a compromised supplier email account	Chief Financial Officer	RC-03 Financial fraud	Cautious	Medium	High	3	3	9	High	Outside appetite, within tolerance	Amber	[[Set with the Chief Financial Officer]]				[[Set with the Chief Financial Officer]]				Set the thresholds with the risk owner (MR-07)	[[Ask the risk owner at what value of this indicator they would score the likelihood one step higher, and at what value the impact as well (A08).]]	[[Name, date]]	No
MC-13	Risks outside appetite and past tolerance	All top risks	Head of Information Security	All categories										Any top risk outside appetite	—	—		Any top risk past tolerance	—	—		OK	Its zones are the P03 positions themselves: amber when any top risk is outside appetite, red when any is past tolerance. The zone follows the P03 position rule, so this KRI has no thresholds of its own and no single risk behind it.	[[Name, date]]	Yes
MC-20	Concentration	R-06 Managed IT provider fails or is compromised	Head of IT	RC-05 Third-party dependency	Cautious	Medium	High	3	1	3	Low	Within appetite	Green	8 providers	3	3	Outside appetite, within tolerance	10 providers	4	3	Outside tolerance	OK	Six providers each carry two or more of the five critical services (P06), and R-06's rating (Unlikely) assumes that many. At 8 the owner would expect one provider failure to take out two services at once within the year: likelihood Likely. At 10 one failure could also stop a core service outright: impact Severe as well.	[[Name, date]]	Yes
MC-23	Access that should not have existed	R-07 Administrator misuses privileged access	Head of IT	RC-06 People and insider	Cautious	Medium	High	3	1	3	Low	Within appetite	Green	[[Set with the Head of IT]]				[[Set with the Head of IT]]				Set the thresholds with the risk owner (MR-07)	[[Ask the risk owner at what value of this indicator they would score the likelihood one step higher, and at what value the impact as well (A08).]]	[[Name, date]]	No
MC-34	Phishing compromises	R-09 Staff account taken over through phishing	HR Director	RC-06 People and insider	Cautious	Medium	High	2	3	6	Medium	Within appetite	Green	2 incidents in 3 months	2	4	Outside appetite, within tolerance	4 incidents in 3 months	3	4	Outside tolerance	OK	One phishing compromise a quarter is what R-09's likelihood (Likely: has happened to us, and the gap is still open) already assumes. Two in three months means attempts are getting through with little in the way: likelihood Almost certain. Four means the owner would expect one to lose data or money: impact one step higher as well.	[[Name, date]]	Yes
MC-35	Critical systems without a checked restore	R-10 Backups cannot restore a critical system	Head of IT	RC-01 Service availability	Cautious	Medium	High	4	1	4	Medium	Within appetite	Green	2 critical systems	4	2	Outside appetite, within tolerance	3 critical systems	4	3	Outside tolerance	OK	One critical system past its restore check is what R-10's rating (Unlikely) assumes, as the checks rotate through the year. With two unchecked, the owner would expect a backup that does not restore to be found in an incident: likelihood Possible. With three, Likely. Impact is already Severe.	[[Name, date]]	Yes

Choose Yours

Your metrics, each with a tolerance or thresholds and its roles. Yellow columns are yours. The 19 EXAMPLE rows are the example organisation's set for September 2026: delete them first.

Example	Metric ID	Metric (calc)	Type (calc)	Owning pack (calc)	Board measure it feeds (calc)	Audience (calc)	Target — the owning pack's (calc)	Tolerance (KPI)	KRI thresholds (calc)	Data supplier	Validator	Metric owner	Selection no. (calc)	Check (calc)
EXAMPLE	MC-13	Risks outside appetite and past tolerance	KRI	P05	BM-01 Risks outside appetite	Operational and executive	Zero past tolerance; outside appetite each with a treatment decision		Set	Assessor	Head of Information Security	Head of Information Security	1	OK
EXAMPLE	MC-14	Treatment actions overdue	KPI	P05	—	Operational and executive	Zero older than 30 days	Same as the target	—	Head of Risk	Assessor	Head of Information Security	2	OK
EXAMPLE	MC-15	Acceptances past review	KPI	P05	—	Operational and executive	Zero	Same as the target	—	Assessor	Head of Information Security	Head of Information Security	3	OK
EXAMPLE	MC-17	Tier 1 suppliers assessed	KPI	P06	BM-05 Critical suppliers assessed	Operational and executive	All Tier 1 by [[year end]]	[[No more than 2 Tier 1 suppliers neither assessed nor booked before year end]]	—	Procurement Manager	Assessor	Head of Information Security	4	OK
EXAMPLE	MC-19	High findings past deadline	KPI	P06	—	Operational and executive	Zero	1 High finding past deadline	—	Assessor	Head of Information Security	Head of Information Security	5	OK
EXAMPLE	MC-20	Concentration	KRI	P06	—	Operational and executive	Each one known, with an exit plan (TP-11)		Set	Procurement Manager	Assessor	Head of Information Security	6	OK
EXAMPLE	MC-22	Removals confirmed on time	KPI	P07	—	Operational and executive	≥ [[95%]]	90%	—	System administrator	Campaign coordinator	Head of Information Security	7	OK
EXAMPLE	MC-24	Process weaknesses open	KPI	P07	—	Operational	Zero past their date	Same as the target	—	Campaign coordinator	Head of Information Security	Head of Information Security	8	OK
EXAMPLE	MC-25	Significant incidents and time to contain	KPI	P09	BM-04 Significant incidents and time to contain	Operational and executive	Each contained within [[24]] hours	Each contained within 48 hours (P03 BM-04)	—	Incident manager	Head of Information Security	Head of Information Security	9	OK
EXAMPLE	MC-26	Reports made on time	KPI	P09	—	Operational and executive	All	Same as the target	—	Incident manager	Data Protection Officer	Head of Information Security	10	OK
EXAMPLE	MC-27	Review actions overdue	KPI	P09	—	Operational and executive	None more than 30 days overdue	Same as the target	—	Incident manager	Head of Information Security	Head of Information Security	11	OK
EXAMPLE	MC-28	Months since the plan was last exercised	KPI	P09	—	Operational and executive	12 or fewer	Same as the target	—	Incident manager	Head of Information Security	Head of Information Security	12	OK
EXAMPLE	MC-29	Audiences exercised within their interval	KPI	P10	—	Operational and executive	All four	2 of 4	—	Exercise lead	Exercise sponsor	Exercise lead	13	OK
EXAMPLE	MC-31	Exercise actions overdue	KPI	P10	—	Operational and executive	None more than 30 days overdue	Same as the target	—	Exercise lead	Exercise sponsor	Exercise lead	14	OK
EXAMPLE	MC-34	Phishing compromises	KRI	P11	—	Operational and executive	— (KRI: see KRI Thresholds)		Set	Incident manager	Head of Information Security	Head of Information Security	15	OK
EXAMPLE	MC-35	Critical systems without a checked restore	KRI	P11	BM-06 Critical services restored in tests	Operational and executive	— (KRI: see KRI Thresholds)		Set	IT Operations Manager	Information Security Manager	Head of IT	16	OK
EXAMPLE	MC-36	Staff security training completion	KPI	P11	BM-08 Board and staff security training	Operational and executive	[[95%]]	85% (P03 BM-08)	—	HR Learning Lead	Information Security Manager	Head of Information Security	17	OK
EXAMPLE	MC-38	Figures that failed a quality check	KPI	P11	—	Operational and executive	None reported with a caveat or withheld	[[1 figure reported with a caveat or withheld]]	—	Information Security Manager	Head of Information Security	Head of Information Security	18	OK
EXAMPLE	MC-39	KRI escalations made on time	KPI	P11	—	Operational and executive	All	[[Same as the target: every escalation on time]]	—	Information Security Manager	Head of Information Security	Head of Information Security	19	OK

Selection Check

Selection check

Your selection on Choose Yours against the pack's rules. Every line should say 'Meets the check' before the first value is reported.

Checks

Check	Result	Status	What it means
Metrics chosen	19	Meets the check	Every chosen metric needs a definition card before its first value is reported (MR-02).
KPIs chosen	15	—	Judged against a target and a tolerance.
KRIs chosen	4	Meets the check	Judged against thresholds tied to appetite. A set with no KRI gives no early warning.
Rows with a check to resolve	0	Meets the check	Any row on Choose Yours whose Check does not say OK.
Metrics chosen more than once	0	Meets the check	Keep one row per metric.
KPIs with no tolerance	0	Meets the check	Without a tolerance any miss of the target reads as Outside tolerance.
KRIs without approved thresholds	0	Meets the check	Every KPI must have a target, and every KRI green, amber and red thresholds. A KRI's thresholds are set from the appetite and tolerance of the risk it indicates (P05) and approved by that risk's owner.
Metrics where supplier and validator are the same	0	Meets the check	The person who validates an input must not be the person who supplied it.
Metrics with no owner	0	Meets the check	Every metric must have one owner, who interprets it and answers for it, and one data supplier for each input. Each is a person in a named role, never a team or a tool.
MC-13 Risks outside appetite and past tolerance chosen	1	Meets the check	Every report opens by saying whether you are within appetite (P03 BR-02). MC-13 answers it, and feeds BM-01.

Overall

Ready

The number of checks above that do not yet say 'Meets the check'.

Board measures your selection feeds (Board Cybersecurity Reporting, P03)

Board measure	Chosen metrics feeding it	Fed?	Catalogue metrics that can feed it
BM-01 Risks outside appetite	1	Fed	MC-13. If none is chosen, the board report takes BM-01 from risk register.
BM-02 Critical exposure fixed on time	0	Not fed	MC-03. If none is chosen, the board report takes BM-02 from vulnerability remediation tracker (P01).
BM-03 Expired or high-risk exceptions	0	Not fed	MC-06. If none is chosen, the board report takes BM-03 from security exception register (P02).
BM-04 Significant incidents and time to contain	1	Fed	MC-25. If none is chosen, the board report takes BM-04 from incident log.
BM-05 Critical suppliers assessed	1	Fed	MC-17. If none is chosen, the board report takes BM-05 from third-party register.
BM-06 Critical services restored in tests	1	Fed	MC-35. If none is chosen, the board report takes BM-06 from recovery test records.
BM-07 Security programme delivery	0	Own source	No catalogue metric: the board report takes BM-07 from programme plan.
BM-08 Board and staff security training	1	Fed	MC-36. If none is chosen, the board report takes BM-08 from training records.

Your selection by owning pack and audience

Group	Chosen	Note
P01 Vulnerability & Exposure Management	0	Definition and target from that pack, unchanged (MR-04).
P02 Security Exception, Waiver & Segregation of Duties	0	Definition and target from that pack, unchanged (MR-04).
P04 Security Policy Management	0	Definition and target from that pack, unchanged (MR-04).
P05 Information Security Risk Management	3	Definition and target from that pack, unchanged (MR-04).
P06 Third-Party Security Risk Management	3	Definition and target from that pack, unchanged (MR-04).
P07 User Access Review	2	Definition and target from that pack, unchanged (MR-04).
P09 Security Incident Management	4	Definition and target from that pack, unchanged (MR-04).
P10 Cyber Incident Exercises & Tabletop Scenario Library	2	Definition and target from that pack, unchanged (MR-04).
P11 Cybersecurity Metrics & Reporting Programme	5	This pack's own metrics.
Audience: Operational only	1	On the Operational Security Metrics Dashboard only (monthly).
Audience: Operational and executive	18	Also in the Executive Committee Security Report Deck (monthly).

EXAMPLE rows on Choose Yours are counted until you delete them.

Lists

Type	Theme	Audience	LeadLag	LevelName	LevelAppetite	LevelTolerance	BandName	BandMin
KPI	Risk and appetite	Operational	Leading	Averse	Low	Medium	Low	1
KRI	Vulnerabilities and exposure	Operational and executive	Lagging	Cautious	Medium	High	Medium	4
	Accepted risk		—	Open	High	High	High	8
	Incidents and detection						Critical	12

Suppliers

Resilience and recovery

Programme and investment

People and behaviour

Identity and access

Threat activity

Assurance and compliance

Metrics programme

Definitions

Definitions

Term	Meaning in this workbook
Metric	A number defined once, on a definition card, that answers one question for one audience: what is counted, how, from which source, by whom and how often.
Measure	The word P03 and the other packs use for a metric. In this pack the two mean the same.
KPI	Key performance indicator. A metric that shows whether a control or process is working as intended, judged against a target.
KRI	Key risk indicator. A metric that gives early warning that a risk in the risk register may be moving, judged against thresholds set from that risk's appetite and tolerance.
Target	The value of a KPI the organisation is aiming for. A KPI at or better than its target is On target. For a metric another pack owns, that pack's target, unchanged (MR-04).
Tolerance	The limit beyond which the people who set it must act, and not just be told. For a risk, the highest residual band tolerated while a plan brings it back (P05). For a KPI, the furthest short of target the audience accepts without a decision (P03).
Appetite	The highest residual band of risk accepted without escalation, set by risk category (P05).
Threshold	A value of a KRI at which its zone changes: green to amber, or amber to red.
Zone	Where a KRI's value falls: green, amber or red. The zone says what the value suggests about the linked risk. It never changes the risk's position on its own: only a reassessment in the risk register does that (P05).
Zone — Green	Green: consistent with the risk within appetite. The indicator is where the risk owner expects it while the linked risk is within appetite.
Zone — Amber	Amber: the risk may be above appetite. The indicator is at a level at which the linked risk may have moved above appetite. The risk owner reviews it.
Zone — Red	Red: the risk may be past tolerance. The indicator is at a level at which the linked risk may have moved past tolerance. Executive management is told and the risk is reassessed.
Status — On target	At or better than its target.
Status — Below target, within tolerance	Short of its target but inside the tolerance the board set; a plan and date are given.
Status — Outside tolerance	Beyond the limit at which the board said it must act, not just be told; an ask follows (BR-06).
Status — No target set	Reported without a target: it should not reach the board until one is set (BR-03).
Appetite level	How much of a risk category the organisation accepts: Averse (appetite Low, tolerance Medium); Cautious (appetite Medium, tolerance High); Open (appetite High, tolerance High). Set in the risk methodology (P05).
Residual score	Impact times likelihood after existing controls, each 1 to 4 (impact Minor, Moderate, Major, Severe; likelihood Unlikely, Possible, Likely, Almost certain). Bands: Low 1–3, Medium 4–6, High 8–9, Critical 12–16.
Stands for	The impact and likelihood the risk owner would score if the indicator reached the threshold. Its position against appetite shows whether the threshold is in the right place.
Threshold method	Start from the linked risk in the risk register: its residual impact and likelihood, and its category's appetite level (P05). Ask the risk owner: at what value of this indicator would you score the likelihood one step higher? At what value would you also score the impact higher? Work out the residual score each answer would give, and its position against appetite and tolerance (P05). The amber threshold is the first value at which the position would be Outside appetite, within tolerance. The red threshold is the first value at which it would be Outside tolerance. Where the category's appetite and tolerance are the same band (the Open level), there is no amber zone: the KRI goes from green to red. Where the linked risk is already outside appetite, the KRI starts in amber. Green is then the treatment's target, and red still marks tolerance. The risk owner approves the thresholds, and they are written on the card with the reasoning. They are reviewed whenever the appetite statement changes (MR-09).
Leading	An indicator that moves before harm is done, such as weaknesses past their fix deadline.
Lagging	An indicator that moves only after harm is done, such as incidents. Useful, but on its own too late to warn.
Owning pack	The pack that defines a metric and its target. A change is made there, never here (MR-04).
Board measure	One of the eight measures of the Board Cybersecurity Reporting pack (BM-01 to BM-08), reported to the board or committee quarterly. The catalogue feeds them and never copies them.
Data supplier	The person who provides an input to a metric each period, from a named source.
Validator	The person who runs the quality checks on an input and accepts or rejects it. Never the person who supplied it.
Metric owner	The person who interprets a metric, writes the commentary and answers for it. One per metric.
Reporter	The person who puts validated values into the report for an audience.
Definition card	The one-page specification of a metric: the question it answers, the decision it informs, the formula, the source, the roles, the checks, the target or thresholds and the known limits.
MR-nn	The rules of the Security Metric Definition & Measurement Method (MR-01 to MR-12).
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, its metrics for September 2026. Delete the EXAMPLE rows on Choose Yours, and enter your own risks on KRI Thresholds, before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	The catalogue: what is measured, how, from which source, by whom and how often
NIST CSF 2.0	GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed”	Choose Yours and the Selection Check: the metrics performance is evaluated on
NIST CSF 2.0	GV.RM-02 — “Risk appetite and risk tolerance statements are established, communicated, and maintained”	KRI Thresholds: thresholds set from appetite and tolerance
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	The catalogue as the measures used to assess whether risk-management measures work
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 7.2 — taking into account the risk assessment and past significant incidents, determine what is monitored and measured, the methods “to ensure valid results”, when it is measured, who measures, when the results are analysed and evaluated, and who analyses and evaluates them	Data supplier, validator and metric owner: who measures, and who analyses and evaluates
DORA — Regulation (EU) 2022/2554	Article 6(8)(c) — the strategy sets out “clear information security objectives, including key performance indicators and key risk metrics”	KPIs and KRIs with targets and thresholds
DORA — Regulation (EU) 2022/2554	Article 6(8)(f) — the strategy evidences the current digital operational resilience situation on the basis of the number of major ICT-related incidents reported and the effectiveness of preventive measures	MC-25 and MC-26: incidents reported; KPIs on preventive measures

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA)