Title/name of metric Coordinated Business Continuity Plans
Primary customer Security management & executives
Information source/s All business units or contingency planning function
Count number of BCPs that have been signed to
How calculated denote review and acceptance by the heads of all
relevant business functions invoked in the plans
Collect & report quarterly in year 1, then half-
Frequency yearly in year 2, then annually (as continuity
processes mature)
Business continuity plans for any department
typically call upon other departments (e.g. IT) but
Rationale for coordination of plans between departments is not
measuring this automatically guaranteed. This metric checks that
plans have been coordinated with and accepted by
all the business functions they invoke.
4 Risk mgmt
8 HR 12 SDLC
Relevant section/s 5 Security policy
9 Physical security 13 Incident mgmt
of ISO/IEC 27002
6 Information security
10 Comms/Ops mgmt 14 Continuity mgmt
Main Subsidiary governance
11 Access control 15 Compliance
7 Asset mgmt
Objective / Subjective / Semi*
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics Number of BCPs successfully tested/exercised
considered
* The metric itself is objective but the degree to
Notes which signatories review and approve the plans
may vary
Title/name of metric Personal device security
Primary customer Security manager / committee
IT Help/Service Desk incident log + automated
Information source/s system logs (e.g. antivirus and antispyware logs)
How calculated # of security incidents / # personal devices x 100%
Frequency Collect daily Report monthly or quarterly
Monitor security risks to personal devices (PDAs,
laptops, mobile phones etc.) that often fall outside
the purview of the Information Security
Rationale for Management System, yet carry sensitive &
measuring this
valuable data. Identify education/awareness
targets and security issues. Ensure policy
compliance.
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Automated compliance checks using automated
Alternative metrics controls e.g. antivirus, security configuration
considered
checkers
Notes
Title/name of metric Payroll data quality
Primary customer Senior management team
Information source/s Payroll database logs and system change records
(#exceptions and corrections processed during the
How calculated period LESS #legitimate data changes) / #records
in the database x 100%
Frequency Weekly collection Quarterly reporting
Measures data integrity failures (completeness,
Rationale for accuracy, timeliness) in an important database
measuring this where the consequences of data errors may be
significant
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics Delayed updates to personnel records
considered
Some payroll data changes are more significant
than others but this metric simply counts the
number of data corrections to assess the accuracy
level. Better automated or manual data entry
Notes controls should reduce the number of errors
having to be corrected.
The same metric can be applied to any database,
ERP or similar system, and compared between
systems.
Title/name of metric Days since a serious security incident
Primary customer Entire workforce (security awareness)
Information source/s IT Help/Service Desk incident logs
#days since an information security incident
How calculated judged by management to have caused “serious”
business impact
Frequency Daily collection and reporting
Rationale for Modern analogue of the old “Days since a lost time
measuring this safety incident” boards outside factories
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics “Security status” or “risk level” (both subjective
considered assessments)
“Serious” may have to be defined formally,
perhaps using example incidents or costs that
Notes
would trigger a reset of the day count.
The metric could be reported by business unit.
Title/name of metric Network capacity
Primary customer CIO
User activity; audit logs; #IDs; IT Help/Service
Information source/s Desk reports; transaction logs; previous trends;
change requests; statutory obligations
How calculated Used / Available network capacity x 100%
Frequency Daily collection, monthly reporting
Ensure availability of sufficient network capacity
Rationale for to meet current business demands (with trends
measuring this
analysis for future projections)
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Capacity of network connections for essential web
servers.
Alternative metrics
considered
#named/registered web services users.
#Failed/Successful web services login attempts.
SLA statistics if web services are outsourced.
Presentation using “highest-mean-lowest” bars,
Notes with commentary on any significant changes from
the norm.
Title/name of metric Customer security sophistication index
Primary customer General manager of eBusiness function
Information source/s Customer survey
Survey using % ranges and key indicators against
How calculated predetermined criteria (e.g. use of antivirus)
Frequency Annual
Customer insecurities could introduce viruses,
create data integrity problems and result in
Rationale for unauthorized disclosure of information affecting
measuring this the organization. Less sophisticated/security
aware customers are likely to have less effective
security controls.
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics General security surveys (not specific to
considered customers)
Might be interesting to compare the ‘customer
security sophistication index’ to the number of
eBusiness security incidents that appear to result
from customer security issues.
Notes
If the survey questionnaire is reviewed/updated
annually, new risks could be reflected.
Security awareness activities targeted at
customers should noticeably improve this index.
Title/name of metric Web abuse
Primary customer HR Department
Information source/s Internet filtering software
#non-acceptable sites / #acceptable sites
How calculated accessed or attempted access during the period
Frequency Collected daily, reported monthly
Policy compliance issue: employees accessing (or
attempting to access) “unacceptable” sites
Rationale for increase the possibility of malware infections, data
measuring this
theft, prosecution for porn & unlicensed software
etc.
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics Separately measure and report successful vs
considered blocked accesses to unacceptable sites.
Could be reported by department to department
managers, allowing benchmarking comparisons.
Assumes “acceptability” of websites has been
defined in policy and web filtering software
Notes configured accordingly. Also assumes tor and
similar proxy sites are blocked (could usefully be
monitored too!).
Metric should improve with user awareness
training and follow-up activities by management.
Title/name of metric Access to controlled facilities
Primary customer Facilities management, CIO
Information source/s Card access control system logs
#unsuccessful / #successful access attempts to
How calculated controlled areas
Frequency Daily collection, monthly reporting
If people are “rattling the doorlocks”, attempting
Rationale for access to controlled areas, this indicates a lax
measuring this
attitude towards physical security.
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics Reports of unauthorized visitors
considered
Further analysis of failed accesses may indicate
systematic issues such as people not having the
correct access rights, using shared cards etc.
Notes Should be coupled with analysis of successful
accesses to secure areas (e.g. confirming that all
who access the area should in fact have that level
of access).
Title/name of metric Security clearance lag time
Primary customer HR Manager, Information Security Manager, CIO
Information source/s HR system
Average #working days between approval of
appointment and security clearance being granted
How calculated or denied for new employees during the reporting
period
Frequency Measured and reported quarterly
If employees are appointed “pending full
clearance”, the longer it takes to complete the
Rationale for police checks the greater the exposure to fraud,
measuring this
theft or other criminal acts by unsuitable
employees.
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Alternative metrics #employees pre-cleared/#appointed without
considered clearance
Might be interesting to breakdown or analyze the
figures according to the nature of job role (e.g. if
appointments to highly responsible positions
Notes require express clearance).
Process delays outside the organization’s control
will heavily influence this metric, although process
improvements may help.
Title/name of metric Proportion of security incidents
Primary customer Information Security Manager, CIO, CEO & Board
IT Help/Service Desk call logging & tracking
Information source/s system,
#security incidents / #all incidents reported in
How calculated reporting period
Weekly (ISM), Monthly (CIO), quarterly (CEO &
Frequency Board)
Rationale for We would expect security awareness activities to
measuring this drive up the reporting of security incidents
4 Risk mgmt 8 HR 12 SDLC
Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance
Objective / Subjective / Semi
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Other security awareness metrics e.g. proportion
of employees that have completed some form of
Alternative metrics security awareness training during the period, or
considered
have signed their acceptance of security policies
and related obligations.
Would require care to ensure that security-related
incidents are correctly categorized by the Help
Notes Desk. Does not take account of the differing
severity of security incidents.
