Metrics and measurements

- [Narrator] Organizations evaluate their security programs…through the use of metrics, that assess the efficiency…and effectiveness of critical security controls.…These measurements provide insight into the health…of the security program, both at a single point in time…and over a long term basis.…It's critical that organizations define the metrics…and performance measurements they will use…in advance of reporting the data.…This ensures the integrity of the process…and prevents the cherry picking of favorable results…for reporting purposes.…

Security programs use two primary types of metrics…to demonstrate their effectiveness…and the state of the organization's security controls.…Key performance indicators or KPIs are metrics…that demonstrate the success of the security program…in achieving its objectives.…KPIs are mutually agreed upon measures…that evaluate whether a security program…is meeting its defined goals.…Generally speaking, KPIs are a look backwards…at historical performance.…

Providing a yardstick to evaluate the past success…