ID.IM-03.188
Does your organization use metrics to track and evaluate cybersecurity performance over time?
Explanation
Cybersecurity metrics provide quantifiable data to assess the effectiveness of security controls, identify trends, and make informed decisions about resource allocation and risk management. Examples include number of security incidents, mean time to detect/respond, patch management compliance rates, and security training completion percentages.
Evidence could include dashboards or reports showing tracked security metrics over time (with sensitive data redacted), documentation of how metrics are collected and analyzed, or meeting minutes demonstrating how metrics inform security decisions and improvements.
Implementation Example
Use metrics to assess operational cybersecurity performance over time
ID: ID.IM-03.188
Context
- Function
- ID: IDENTIFY
- Category
- ID.IM: Improvement
- Sub-Category
- Improvements are identified from execution of operational processes, procedures, and activities
Related questions
- Does your organization regularly conduct self-assessments of critical services that incorporate current threat intelligence and adversary tactics, techniques, and procedures (TTPs)?
- Has your organization conducted third-party assessments or independent audits of your cybersecurity program within the past 12 months?
- Does your organization utilize automated tools or systems to continuously evaluate compliance with your established cybersecurity requirements?
- Does your organization have a process to identify and implement improvements to incident response procedures based on findings from exercises, tests, and reviews?
- Does your organization have a formal process to identify and implement improvements to business continuity, disaster recovery, and incident response plans based on exercises conducted with critical service providers and suppliers?
- Does your organization involve internal stakeholders (such as senior executives, legal, and HR) in security tests and exercises?