Does your organization collect and analyze security performance metrics to drive improvements to your cybersecurity program?

This question assesses whether your organization has established a data-driven approach to security by measuring the effectiveness of security controls and using those insights to make informed improvements. Performance metrics might include mean time to detect/respond to incidents, vulnerability remediation times, security tool coverage, or false positive rates from security monitoring tools. Evidence could include dashboards or reports showing security metrics over time with trend analysis, documentation of program improvements made based on metric findings, or meeting minutes where security metrics were reviewed and acted upon by leadership.