Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Tools · Cybersecurity Metrics & Reporting Programme

How mature is our metrics programme?

Answer 8 questions about how your security metrics work today, from what each number is for to whether anyone checks it before it is reported. You get up to three next actions, each with the document that helps. Free, no account, and nothing is stored.

Part 1 of 1 · 0 of 8 answered

The 8 dimensions

Each dimension describes each level in its own terms.

Answer for what happens now, not what the policy says. If you are between two, choose the lower.

MD-01 Decision link Does every metric answer a question tied to a decision?
Rules
MR-01
MD-02 Definitions Is every metric defined once, and used the same way everywhere?
Rules
MR-02, MR-04
MD-03 Ownership Does every number arrive with an owner?
Rules
MR-03, MR-06
MD-04 Data quality Are figures checked before anyone sees them?
Rules
MR-05
MD-05 Thresholds and escalation Do KRIs have thresholds tied to appetite, and are breaches escalated?
Rules
MR-07, MR-08
MD-06 Audience and cadence Does each audience get the metrics it decides on, when it needs them?
Rules
MR-10, MR-12
MD-07 Consistency between periods Can this period be compared with the last?
Rules
MR-09
MD-08 Review and retirement Are metrics that drive no decision dropped?
Rules
MR-11

You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.

How this is worked out, and what it is not

  1. Each dimension's result is its level in words. The next actions are the dimensions at the lowest level found, then the next lowest, earlier dimensions first, up to three. A dimension at Managed gives no action. There is no overall score.
  2. The order: the lowest levels come first and, at the same level, the earlier dimension. A dimension at Managed or not answered gives no action.
  3. Each next action is the description of the next level up for that dimension, with the pack document that helps.
  4. The workbook also reviews each metric you report against six questions and lists the metrics to drop and to fix. That part stays in the workbook.

Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.

  • This is a self-check. It is only as accurate as the answers, and people tend to answer for what the policy says rather than what happens. Noting the evidence behind each answer is the best check; a second person answering separately is better still.
  • It assesses how the metrics programme works, not whether security is good. A Managed programme can report a poor position accurately: that is its job.
  • The levels are not a benchmark. They cannot be compared with other organisations or with any certification requirement, and they are not added up: there is no overall score.
  • The metric review asks six questions of each metric. A metric kept after the review still needs its definition card, thresholds or target, and owner in place before it is reported (MR-02).
From
Metrics Programme Maturity Self-Check, version 1.0
Questions
8 dimensions