How to choose, build and present reliable cybersecurity KPIs and KRIs, drawing on ISO/IEC 27004 and the NIST SP 800-55 guidance.
Security metrics turn cybersecurity activity into information that supports decision-making. KPIs (key performance indicators) measure the effectiveness of security processes and controls; KRIs (key risk indicators) signal changes in exposure. A good dashboard contains only a few of them, selected according to the organization's objectives and risks.
KPIs and KRIs: what are we talking about?
A KPI answers the question "are we doing well what we decided to do?". Examples: the percentage of endpoints with an active EDR, the mean time to handle an incident, the completion rate of the awareness plan.
A KRI answers the question "is our exposure increasing?". It serves as an early warning and comes with a tolerance threshold. Examples: the number of critical vulnerabilities exposed on the Internet beyond the remediation deadline, the number of privileged accounts without MFA, the share of critical suppliers that have not been assessed.
The same data can serve both purposes; it is the objective that changes how it is read.
Reference standards
You do not have to invent a method. Several frameworks guide the approach:
ISO/IEC 27001 requires, in clause 9.1, determining what needs to be monitored and measured, with which methods, how often, and by whom the results are analyzed; ISO/IEC 27004 provides detailed guidelines for meeting this requirement;
in December 2024, NIST published the two volumes of SP 800-55: the first helps identify and select measures, the second helps build a measurement program; it notably distinguishes between implementation, effectiveness, efficiency and impact measures;
the NIST Cybersecurity Framework 2.0 can be used as a grid to check that your indicators cover all six functions: govern, identify, protect, detect, respond and recover.
Useful indicators by domain
Here are examples to adapt to your context, not a list to be adopted in full:
vulnerability management: mean time to remediate by severity level, share of assets scanned, critical vulnerabilities still open beyond the target deadline;
detection and response: mean time to detect, mean time to resolve, proportion of incidents detected by your own tools rather than reported by a third party;
identities: privileged accounts covered by MFA, inactive accounts not yet disabled, time taken to revoke access when an employee leaves;
awareness: the reporting rate during phishing exercises, and not only the click rate;
resilience: the share of backups tested through an actual restore, and whether recovery objectives are met during exercises;
third parties: critical suppliers assessed during the year, and security clauses included in contracts.
Building a reliable indicator
Each indicator deserves a description sheet, in line with the recommendations of ISO/IEC 27004 and SP 800-55:
objective: which decision should the indicator inform?
calculation formula and unit;
data source and collection method, preferably automated;
measurement and reporting frequency;
target and alert thresholds;
owner of the measurement and recipient of the results.
Check data quality: an incomplete asset inventory distorts every percentage that depends on it. An indicator whose source is unreliable should be flagged as such, or even withdrawn.
Reporting to the right audiences
A single measurement program feeds several levels of reporting. The operational team follows detailed indicators every week. The CISO consolidates monthly trends and compares them with targets. Senior management expects only a few indicators, expressed in terms of risk and business impact, together with a recommendation. Present trends rather than isolated values, and always explain what has changed.
Pitfalls to avoid
Measuring what is easy instead of what matters: the number of attacks blocked by the firewall says nothing about your level of protection.
Piling up indicators: beyond a dozen at the senior management level, nobody reads them anymore.
Creating perverse incentives: a target for closing tickets quickly can encourage closing them without actually resolving the issue.
Never reviewing them: an indicator that consistently meets its target can be replaced by a more demanding one.
Skills and training
Managing security through indicators falls within governance and risk management. These learning paths will prepare you:
ISC2 CISSP for a comprehensive governance perspective, useful for CISOs.
Conclusion
A good metrics program does not aim to be exhaustive: it selects a few reliable indicators, linked to objectives and risks, and keeps them relevant over time. Rely on ISO/IEC 27004 and SP 800-55 to structure the approach, and then adjust your indicators as your maturity grows.