Title/name of metric Coordinated Business Continuity Plans

Primary customer Security management & executives

Information source/s All business units or contingency planning function

Count number of BCPs that have been signed to

How calculated denote review and acceptance by the heads of all
relevant business functions invoked in the plans
Collect & report quarterly in year 1, then half-
Frequency yearly in year 2, then annually (as continuity
processes mature)

Business continuity plans for any department

typically call upon other departments (e.g. IT) but
Rationale for coordination of plans between departments is not
measuring this automatically guaranteed. This metric checks that
plans have been coordinated with and accepted by
all the business functions they invoke.

4 Risk mgmt
8 HR 12 SDLC
Relevant section/s 5 Security policy
9 Physical security 13 Incident mgmt
of ISO/IEC 27002
6 Information security
10 Comms/Ops mgmt 14 Continuity mgmt
Main Subsidiary governance
11 Access control 15 Compliance
7 Asset mgmt
Objective / Subjective / Semi*
Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics Number of BCPs successfully tested/exercised

considered

* The metric itself is objective but the degree to

Notes which signatories review and approve the plans
may vary
Title/name of metric Personal device security

Primary customer Security manager / committee

IT Help/Service Desk incident log + automated

Information source/s system logs (e.g. antivirus and antispyware logs)

How calculated # of security incidents / # personal devices x 100%

Frequency Collect daily Report monthly or quarterly

Monitor security risks to personal devices (PDAs,

laptops, mobile phones etc.) that often fall outside
the purview of the Information Security
Rationale for Management System, yet carry sensitive &
measuring this
valuable data. Identify education/awareness
targets and security issues. Ensure policy
compliance.

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Automated compliance checks using automated
Alternative metrics controls e.g. antivirus, security configuration
considered
checkers

Notes
Title/name of metric Payroll data quality

Primary customer Senior management team

Information source/s Payroll database logs and system change records

(#exceptions and corrections processed during the

How calculated period LESS #legitimate data changes) / #records
in the database x 100%
Frequency Weekly collection Quarterly reporting

Measures data integrity failures (completeness,

Rationale for accuracy, timeliness) in an important database
measuring this where the consequences of data errors may be
significant

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics Delayed updates to personnel records

considered

Some payroll data changes are more significant

than others but this metric simply counts the
number of data corrections to assess the accuracy
level. Better automated or manual data entry
Notes controls should reduce the number of errors
having to be corrected.
The same metric can be applied to any database,
ERP or similar system, and compared between
systems.
Title/name of metric Days since a serious security incident

Primary customer Entire workforce (security awareness)

Information source/s IT Help/Service Desk incident logs

#days since an information security incident

How calculated judged by management to have caused “serious”
business impact
Frequency Daily collection and reporting

Rationale for Modern analogue of the old “Days since a lost time
measuring this safety incident” boards outside factories

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics “Security status” or “risk level” (both subjective

considered assessments)

“Serious” may have to be defined formally,

perhaps using example incidents or costs that
Notes
would trigger a reset of the day count.
The metric could be reported by business unit.
Title/name of metric Network capacity

Primary customer CIO

User activity; audit logs; #IDs; IT Help/Service
Information source/s Desk reports; transaction logs; previous trends;
change requests; statutory obligations
How calculated Used / Available network capacity x 100%

Frequency Daily collection, monthly reporting

Ensure availability of sufficient network capacity

Rationale for to meet current business demands (with trends
measuring this
analysis for future projections)

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Capacity of network connections for essential web

servers.
Alternative metrics
considered
#named/registered web services users.
#Failed/Successful web services login attempts.
SLA statistics if web services are outsourced.
Presentation using “highest-mean-lowest” bars,
Notes with commentary on any significant changes from
the norm.
Title/name of metric Customer security sophistication index

Primary customer General manager of eBusiness function

Information source/s Customer survey

Survey using % ranges and key indicators against

How calculated predetermined criteria (e.g. use of antivirus)

Frequency Annual
Customer insecurities could introduce viruses,
create data integrity problems and result in
Rationale for unauthorized disclosure of information affecting
measuring this the organization. Less sophisticated/security
aware customers are likely to have less effective
security controls.

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics General security surveys (not specific to

considered customers)

Might be interesting to compare the ‘customer

security sophistication index’ to the number of
eBusiness security incidents that appear to result
from customer security issues.
Notes
If the survey questionnaire is reviewed/updated
annually, new risks could be reflected.
Security awareness activities targeted at
customers should noticeably improve this index.
Title/name of metric Web abuse

Primary customer HR Department

Information source/s Internet filtering software

#non-acceptable sites / #acceptable sites

How calculated accessed or attempted access during the period

Frequency Collected daily, reported monthly

Policy compliance issue: employees accessing (or
attempting to access) “unacceptable” sites
Rationale for increase the possibility of malware infections, data
measuring this
theft, prosecution for porn & unlicensed software
etc.

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics Separately measure and report successful vs

considered blocked accesses to unacceptable sites.

Could be reported by department to department

managers, allowing benchmarking comparisons.
Assumes “acceptability” of websites has been
defined in policy and web filtering software
Notes configured accordingly. Also assumes tor and
similar proxy sites are blocked (could usefully be
monitored too!).
Metric should improve with user awareness
training and follow-up activities by management.
Title/name of metric Access to controlled facilities

Primary customer Facilities management, CIO

Information source/s Card access control system logs

#unsuccessful / #successful access attempts to

How calculated controlled areas

Frequency Daily collection, monthly reporting

If people are “rattling the doorlocks”, attempting

Rationale for access to controlled areas, this indicates a lax
measuring this
attitude towards physical security.

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics Reports of unauthorized visitors

considered

Further analysis of failed accesses may indicate

systematic issues such as people not having the
correct access rights, using shared cards etc.
Notes Should be coupled with analysis of successful
accesses to secure areas (e.g. confirming that all
who access the area should in fact have that level
of access).
Title/name of metric Security clearance lag time

Primary customer HR Manager, Information Security Manager, CIO

Information source/s HR system

Average #working days between approval of

appointment and security clearance being granted
How calculated or denied for new employees during the reporting
period
Frequency Measured and reported quarterly
If employees are appointed “pending full
clearance”, the longer it takes to complete the
Rationale for police checks the greater the exposure to fraud,
measuring this
theft or other criminal acts by unsuitable
employees.

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability

Alternative metrics #employees pre-cleared/#appointed without

considered clearance

Might be interesting to breakdown or analyze the

figures according to the nature of job role (e.g. if
appointments to highly responsible positions
Notes require express clearance).
Process delays outside the organization’s control
will heavily influence this metric, although process
improvements may help.
Title/name of metric Proportion of security incidents

Primary customer Information Security Manager, CIO, CEO & Board

IT Help/Service Desk call logging & tracking

Information source/s system,

#security incidents / #all incidents reported in

How calculated reporting period
Weekly (ISM), Monthly (CIO), quarterly (CEO &
Frequency Board)

Rationale for We would expect security awareness activities to

measuring this drive up the reporting of security incidents

4 Risk mgmt 8 HR 12 SDLC

Relevant section/s 5 Security policy 9 Physical security 13 Incident mgmt
of ISO/IEC 27002
Main Subsidiary 6 Infosec governance 10 Comms/Ops mgmt 14 Continuity mgmt
7 Asset mgmt 11 Access control 15 Compliance

Objective / Subjective / Semi

Leading / Lagging / Semi
Nature of metric Absolute / Relative (trend) / Semi
Soft / Hard / Semi
Confidentiality / Integrity / Availability
Other security awareness metrics e.g. proportion
of employees that have completed some form of
Alternative metrics security awareness training during the period, or
considered
have signed their acceptance of security policies
and related obligations.
Would require care to ensure that security-related
incidents are correctly categorized by the Help
Notes Desk. Does not take account of the differing
severity of security incidents.