Does your organization use metrics to track and evaluate cybersecurity performance over time?

Cybersecurity metrics provide quantifiable data to assess the effectiveness of security controls, identify trends, and make informed decisions about resource allocation and risk management. Examples include number of security incidents, mean time to detect/respond, patch management compliance rates, and security training completion percentages. Evidence could include dashboards or reports showing tracked security metrics over time (with sensitive data redacted), documentation of how metrics are collected and analyzed, or meeting minutes demonstrating how metrics inform security decisions and improvements.