The Cybersecurity Manager's Guide

Chapter 10. Step 7: Measure What Matters

In Chapter 9, I discussed the importance of having team members who possessed both technical and interpersonal skills. I made this claim because those on your team who are able to walk the halls of your organization spreading the good news of InfoSec while also participating in technical meetings are the individuals on your team who really move your program forward. Once you have your people in place, this next step is about measuring your progress toward a particular goal or objective. This chapter covers the value of metrics, which ones to focus on, and how to use them to improve security for the company.

Why Measure?

If you choose to build your InfoSec program following the seven steps I’ve laid out, measuring your program’s progress along the way will greatly help your cause. Measurement is the tool used to convince management of the progress you’re making year after year.

You’ll use your metrics to highlight to management that their investment in InfoSec is paying off. The front office speaks the language of money. Therefore, you should show in numbers the ROI from InfoSec.

One of the best ways I’ve discovered to show this ROI is to illustrate that the company is more secure this year than last year. The way to do that is by capturing a couple of key metrics. Without the hard data, leadership is just taking your word for it.

The tough part will be convincing them you’re measuring the right items and that these items reflect a mature, ...