Does your organization regularly review key performance indicators (KPIs) to verify that security policies and procedures are achieving their intended objectives?
Explanation
Measuring policy effectiveness is the focus here, asking whether you set KPIs for your security policies and procedures and review them to confirm objectives are met. Effective KPIs might include metrics such as percentage of employees completing security training, number of security incidents, mean time to detect/respond to incidents, or compliance rates with specific security controls.
Evidence could include documentation of security KPIs, meeting minutes from security review sessions, dashboards or reports showing KPI tracking over time, and documented actions taken in response to KPI reviews that didn't meet targets.
Implementation Example
Review key performance indicators (KPIs) to ensure that organization-wide policies and procedures achieve objectives
ID: GV.OV-03.063
Context
- Function
- GV: GOVERN
- Category
- GV.OV: Oversight
- Sub-Category
- Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
Related questions
- Has your organization established metrics to evaluate the effectiveness of risk management decisions in achieving business objectives?
- Does your organization regularly review and adjust cybersecurity risk strategies that may be impeding business operations or innovation?
- Has your organization reviewed recent audit findings to verify that your cybersecurity strategy effectively ensures compliance with both internal policies and external regulatory requirements?
- Does your organization regularly evaluate the performance of cybersecurity roles to identify necessary policy improvements?
- Does your organization have a formal process to review and update its cybersecurity strategy following security incidents?
- Does your organization regularly review key risk indicators (KRIs) to identify, assess, and prioritize cybersecurity risks based on their likelihood and potential impact?
