The security culture programme whose design, delivery, and governance this publication has addressed throughout the preceding sections of its security culture domain cannot be assessed for its effectiveness, justified for its continued investment, or improved through its accumulated intelligence without the measurement framework that provides the evidence base connecting the programme’s activities to the security outcomes they are designed to produce. Measurement is not the administrative requirement that the compliance orientation appends to the programme’s delivery as the documentation of completion. It is the governance intelligence function that converts the programme’s operational outputs into the evidence-based direction whose quality determines whether the programme’s continuous improvement is driven by the reality of what is working or the assumptions that measurement would reveal as inaccurate if it were rigorously applied.
The ISO must govern the measurement framework with the same evidence orientation that the human-centric security philosophy has applied to every other dimension of the programme’s design, building the measurement architecture that captures the genuine security culture improvement the programme is producing rather than the activity metrics that the compliance model has historically accepted as evidence of programme effectiveness without the behavioural outcome connection that genuine evidence requires.
The Purpose and Governance of Security Culture Metrics #
The metrics framework serves four distinct governance purposes whose simultaneous satisfaction the measurement architecture must be designed to achieve:
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
