[Cybersecurity Architecture] KPI, Metrics & Dashboards
This post summarizes some Cybersecurity metrics for Board or Risk Committee Reporting.
Why Metric Reporting?
- Reporting leads to success
- Providing overall status of cyber program and its impact on overall enterprise
- Effective allocating of funding resources
- Supporting regulatory reporting requirements
- Quantify cyber resilience leading to reduced customer and shareholder risks
- Provides the context for budget increases
- Need to address current and future threats
- Conveying information to board through metrics
- Frame within maturity, risk, cost
Requirments:
- Must be actionable
- Must have clarity
- Is the cyber program working
- Is the cyber program adequately funded
- Is the cyber program reducing customer and shareholder risk
Common Goals
- Literature review/survey - NIST, FFIEC, CIS, SOC, ISO
- reportable Metrics - As per literature review
- Appropriateness - Effective Decision Making
Cyber Metrics Development Process
- Assess
- Discuss
- Research
- Broader Discussion
- Effective Cyber Metrics
Metric Examples
For Following Common Areas
1. Cybersecurity training
2. Spam / Phishing Email Management
3. Patches Management
4. Antivirus / Antispyware coverage
5. Incidents Management
6. Audits Management
References
- https://www.youtube.com/watch?v=xwMY5LGsutY
- How to Plan for and Implement a Cybersecurity Strategy - https://www.youtube.com/watch?v=u-EQHbqWY60
- Cybersecurity reference architecture - https://learn.microsoft.com/en-us/security/ciso-workshop/ciso-workshop-module-1?view=o365-worldwide
- The Chief Information Security Officer (CISO) Workshop Training - https://learn.microsoft.com/en-us/security/ciso-workshop/the-ciso-workshop
共有 0 条评论