Skip to content
Cyber security roles
ASD ISMISM-0724

ASD ISM 0724 Implement cyber security metrics and KPIs

What it says

The CISO implements cyber security measurement metrics and key performance indicators for their organisation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

The CISO sets up metrics and indicators to measure and track cyber security performance in the organisation.

The Chief Information Security Officer (CISO) sets up ways to measure how well the organisation is protecting itself from cyber threats. This is important because if you don't track your cyber security performance, you might miss weaknesses, which could lead to data breaches, financial loss, or damage to your business's reputation.

Why it matters

Without cyber security metrics and KPIs, the CISO cannot track control effectiveness or risk trends, leaving gaps unnoticed and delaying response to emerging threats.

How to implement

  1. The CISO should start by identifying key areas that need measuring, such as how quickly the IT team responds to security incidents.

    They can do this by consulting with department heads to understand what security issues are most relevant to their day-to-day operations.

  2. IT managers should develop clear and simple Key Performance Indicators (KPIs) that align with the organisation's cyber security goals.

    This could involve measuring how often systems are updated or how many suspicious emails get through to employees.

  3. The IT team should regularly collect data on these KPIs using tools like logs or reports to monitor how well the organisation's cyber defences are functioning.

    This data collection can be automated to ensure it's consistent and timely.

  4. Human Resources should ensure that staff are trained to understand these metrics and why they matter.

    This can include running workshops or sending out easy-to-read guides that explain the role of each metric in maintaining overall security.

  5. The CISO should report the results of these metrics to the board regularly.

    This can be done by presenting a clear and concise dashboard that highlights key areas of concern and suggests improvements to the cyber security strategy.

Keep it running

Define KPIs with owners, data sources, targets and reporting cadence; review monthly against threat changes, and use results to prioritise remediation and risk decisions.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The current list of cyber security metrics and KPIs: Review the document to ensure it includes well-defined metrics relevant to the organisation's security goals.

    Good evidence

    Will list metrics that cover various aspects of security, such as incident response times and the frequency of software updates.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Recent performance reports: Check the reports to see if the organisation tracks its progress against these metrics over time.

    Good evidence

    Includes consistent reporting intervals and clear trends, showing improvement where needed.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Meeting minutes from board reviews of these metrics.

    Look at

    The minutes to see if the board regularly discusses cyber security performance. Good meeting records will show active engagement from the board with follow-up actions noted.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Training records related to these metrics: Examine whether employees have received training that includes information on the relevance and importance of these metrics.

    Good evidence

    Shows regular training sessions along with an attendance list.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of data collection methods.

    Look at

    The tools and processes used to gather data on security performance.

    Good evidence

    Will detail how data is collected, any automation involved, and who oversees its accuracy.

Mappings

Closest match in ASD Essentials for enterprise IT: IT.GOV-04.2, Periodically review cyber security resourcing against threat trends, incidents and organisational change, which partially overlaps with this control.

ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.