Information Security Management Metrics

93

9Chapter

Metrics Development—A

Different Approach

Metrics’ only purpose is decision support. ere is little other reason to implement

them. Whether it is to provide the basis for determining a particular course of

action or response, or to implement a particular solution, or whether, in fact, every-

thing is operating appropriately and moving in the right direction, we measure to

provide a basis for decisions. We measure to manage.

e useful metrics, therefore, are the ones that are relevant to the level and

type of decisions that must be made. e first question to be answered in met-

rics development then is “What kind of decisions are being ...