Security Metrics
What is Security Metrics?
Quantifiable measurements used to assess the effectiveness of security controls, the maturity of security programs, and organizational risk levels.
Frameworks that govern security metrics
What the standards actually require on security metrics
Requirements naming security metrics across 6 standards, quoted from the control text.
Technical and operational metrics are defined and put to use, in line with what the business is trying to achieve, its security requirements and the compliance duties it carries.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::AIS-03 · Application Security Metrics →The CISO implements cyber security measurement metrics and key performance indicators for their organisation.
ISM-0724 · Cyber security metrics and KPIs →Measure application security with technical and operational metrics that link back to security requirements, business objectives and compliance obligations.
CCM-AIS-03 · Application Security Metrics →Collected information is selected through profiles (NSM objects from part 7, IEC 61850-specific monitoring, other SNMP objects, logs), correlated into events and incidents, expressed as security metrics and key performance indicators, and fed to risk managemen...
iec-62351-power-systems-communication-security::90-3:6 · Part 90-3, clause 6: information correlation and presentation (collection profiles for NSM and part 7, IEC 61850-specific monitoring, other SNMP objects, logs; events, incidents and correlations; security metrics; risk management platforms) →The CISO should be accountable for introducing information security measurement metrics and key performance indicators across the agency.
new-zealand-information-security-manual-nzism::3.2.11.C.03 · 3.2.11.C.03 CISO implements security metrics and KPIs →Data are collected to know the degree of implementation of applicable measures and support the annual state-of-security report (Article 32); R1 measures the effectiveness of incident management and R2 the efficiency of the security system in hours and budget.
spain-ens::op.mon.2 · Security metrics →Questions people ask about security metrics
What is Security Metrics?
Why is Security Metrics important for compliance?
Which compliance frameworks address Security Metrics?
Where can I learn more about Security Metrics?
See how Security Metrics applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.