Information Security Management Metrics

98 ◾ Information Security Metrics

9.3 Ranking Metrics and Monitoring Requirements

If the aforementioned four elements constitute the main considerations for

determining whether metrics or monitoring is required, and if so, what an effec-

tive approach is, then a scoring system can be used to guide the selection process

based on risk tolerance and risk management objectives. As we have discussed,

well-instrumented systems monitor and measure only those elements that are

useful or essential to the required management tasks. Assuming a determina-

tion has been made of critical activities and the potential for serious impacts

and tolerance for risk, then the issue of effectiveness must be considered in

terms of the necessity for cert