Has your organization established measurable objectives for cybersecurity risk management?

Measurable objectives provide concrete targets that enable an organization to track progress in managing cybersecurity risks. Examples include metrics for user training completion rates (e.g., 95% of employees complete security awareness training), incident response time targets (e.g., critical vulnerabilities remediated within 48 hours), or specific risk reduction goals for critical systems (e.g., reduce high-risk findings in industrial control systems by 50% year-over-year). Evidence of fulfillment could include a documented cybersecurity program with clearly defined key performance indicators (KPIs), risk management dashboards showing progress against objectives, or regular reports to leadership that track cybersecurity metrics against established targets.