Information Security Management Metrics

26 ◾ Information Security Metrics

metric that management is usually very interested in. In general, the more

sophisticated an organization is, the more various financial metrics are being used

to primarily determine the return on investment for various security projects or

mechanisms. In these cases, financial metrics are used to develop business cases

that justify program expenditures. Considerable research to develop better finan-

cial metrics continues. While financial metrics still suffer from a significant degree

of speculation, they are an important approach for practitioners to consider.

In a compendium of classic papers on measuring corporate performance,

respected management consultant Peter Drucker explains that, historica