What are security metrics?
Security metrics are measurements from which management can read whether agreed security controls are in place and working. ISO/IEC 27001 makes measurement and evaluation mandatory in clause 9.1, but prescribes no particular metrics. Guidance on meeting clause 9.1 is given in ISO/IEC 27004:2016.
A metric is only useful if someone would act differently at a given value. If nobody can be named, the metric does not belong in the report. How metrics fit into building an ISMS is covered in the guide implementing an ISMS.
Metric, KPI and KRI answer different questions
Metric, KPI and KRI answer different questions: a metric describes a state, a KPI measures progress against a target, and a KRI warns of rising risk.
| Term | Question | Characteristic |
|---|---|---|
| Metric | What is the case? | a raw measurement, such as the number of open findings |
| KPI (key performance indicator) | Are we meeting our objective? | a measurement with a target value and a named owner |
| KRI (key risk indicator) | Is our risk rising? | a leading indicator that signals a trend before damage occurs |
A KPI evaluates performance in hindsight; a key risk indicator points at a trend. Measure performance only, and you learn about a problem after it has happened.
Which details does every security metric need?
Every security metric needs six details, or its value cannot be interpreted:
| Detail | Guiding question | Example for "time to remediate critical vulnerabilities" |
|---|---|---|
| Base measure and population | What does the value refer to? | all critical findings from vulnerability scans in the quarter |
| Target or threshold | When does someone have to act? | derived from your own patch policy |
| Data source | Where does the number come from? | the ticketing system, not a manual list |
| Measurement interval | At what interval is it measured? | monthly |
| Recipient | Who receives the value? | head of IT, information security officer |
| Consequence | What happens on a deviation? | escalation to the system owner |
The example is invented for illustration. Without the population, a value cannot be interpreted: twelve open vulnerabilities mean one thing across two hundred systems and something quite different across eight.
The data source decides how long a metric survives. A figure assembled by hand each quarter goes stale between two reports and depends on the person who collects it.
What are examples of security metrics?
Examples of security metrics come from three layers: implementation, process quality and outcome.
| Metric | Layer | Population | Consequence of a deviation |
|---|---|---|---|
| Share of systems in the central inventory | Implementation | all known production systems | trigger onboarding, review the procurement route |
| Coverage of a hardening baseline | Implementation | systems the baseline applies to | justify an exception or schedule implementation |
| Time to remediation by severity | Process quality | findings of the given severity | escalate, look for the cause in the process |
| Share of access requests handled within the agreed period | Process quality | all requests received | adjust capacity or the procedure |
| Share of emergency changes among all changes | Process quality | all changes in the period | review planning lead time and approval practice |
| Share of incidents detected internally rather than reported from outside | Outcome | all confirmed incidents | invest in detection, review reporting channels |
| Results of recovery tests | Outcome | systems with an agreed recovery time | fix the finding, schedule a re-test |
Implementation metrics are easy to collect but say nothing about effectiveness. Outcome metrics show whether the result is changing. A report to management therefore needs a few metrics from each layer rather than many from the first.
The table deliberately gives no target values. Derive targets from your own requirements, contracts and risks, and record the starting value alongside them.
Metrics used to judge people change behaviour
A metric used to judge people changes their behaviour, including where that was never intended. Count reported incidents as a negative and the willingness to report falls, not the number of incidents. Measure the closure rate of findings and findings start being written smaller.
Two countermeasures are available. Paired metrics make the side effect visible: reported incidents alongside time to detection, or the closure rate alongside the share of findings reopened. And management states explicitly that a report is a sign of working awareness, not a sign of failure.
Meaning comes from the time series
Security metrics belong in a fixed reporting cycle and in the management review, where management assesses them alongside audit results, incidents and the state of risk treatment. A single value describes a state; only the trend shows whether the management system is working. A small, stable set that stays comparable across years is therefore worth more than a set that changes with every reporting template.
How to translate technical values into the language of a board is covered in security metrics the board understands.
Where the numbers in Rizzqo come from
Rizzqo computes security metrics from the work itself rather than collecting them for the report. An asset's coverage follows from its finalised requirement answers, and category and framework figures aggregate above that. A daily snapshot records the values, so a trend appears instead of a single moment.
Alongside coverage, the risk side sits in the same data: Rizzqo computes risk from likelihood in per cent and impact in euros through a configurable matrix. A measure reserves its planned risk reduction as a task and applies it only on completion, so residual risk shows the actual state of implementation.