Tenet 10: Measure What Matters #
The value of the security function is only as visible as the quality of the measures used to demonstrate it.
Why This Tenet Matters #
Measurement is the mechanism through which the security function makes its work visible, its decisions defensible, and its progress credible to the stakeholders who fund and depend upon it. Yet security measurement is one of the most persistently underdeveloped disciplines in the field, with many functions defaulting to metrics that are easy to collect rather than genuinely informative, or that report on activity rather than outcomes. The consequence is security reporting that generates noise without insight, satisfies governance requirements without informing decisions, and fails to connect the work of the security team to the business results that senior leaders and boards actually care about. ISOs who invest in measuring what genuinely matters transform reporting from a compliance obligation into a strategic tool, one that builds credibility, supports investment cases, and provides the evidence base needed to continuously improve the security programme.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
