Security Metrics & KPIs Template

This template helps you define and track Key Performance Indicators (KPIs) that demonstrate your ISMS effectiveness.

Understanding Security Metrics

Types of Metrics

Leading Indicators (Preventive):

Predict future security performance
Enable proactive management
Examples: Training completion rates, patch compliance, vulnerability scanning frequency

Lagging Indicators (Detective):

Measure past performance
Show outcomes and results
Examples: Number of incidents, data breaches, downtime

Efficiency Metrics:

Measure resource utilization
Show productivity
Examples: Cost per user protected, security staff ratios

Effectiveness Metrics:

Measure goal achievement
Show how well controls work
Examples: Percentage of incidents prevented, detection rate

Security Metrics Template

Access Control Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Failed Login Attempts	Number of failed authentication attempts per user account per day	< 3 per account per day	SIEM/Active Directory logs	Daily	IT Security
Unauthorized Access Attempts	Number of attempts to access unauthorized resources	Zero	Access logs, SIEM alerts	Daily	Security Team
Access Review Completion	Percentage of scheduled access reviews completed on time	100%	Access review system	Quarterly	Information Security Manager
Privileged Account Compliance	Percentage of privileged accounts following policy (MFA, strong passwords, regular review)	100%	Privileged access management system	Monthly	IT Security
Account Provisioning Time	Average time to provision new user accounts	< 24 hours	HR/IT ticketing system	Monthly	IT Operations
Account De-provisioning Time	Average time to disable accounts after termination	< 4 hours	HR/IT ticketing system	Monthly	IT Operations
Password Policy Compliance	Percentage of accounts compliant with password policy	100%	Active Directory audit	Monthly	IT Security
MFA Adoption Rate	Percentage of users with MFA enabled	100% for privileged, 95% for all users	Authentication system	Monthly	IT Security

Incident Management Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Number of Security Incidents	Total security incidents per month	Trend downward	Incident tracking system	Monthly	Security Operations Center
Incident Detection Time	Average time from incident occurrence to detection	< 1 hour for critical	SIEM timestamps	Monthly	SOC Manager
Incident Response Time	Average time from detection to initial response	< 30 minutes for critical, < 4 hours for high	Incident logs	Monthly	Incident Response Team
Incident Resolution Time	Average time from detection to full resolution	< 24 hours for critical, < 5 days for high	Incident tracking system	Monthly	Incident Response Manager
Incident Recurrence Rate	Percentage of incidents that recur after resolution	< 5%	Incident tracking system	Quarterly	Information Security Manager
Mean Time to Detect (MTTD)	Average time to detect security incidents	< 2 hours	Security monitoring tools	Monthly	SOC Manager
Mean Time to Respond (MTTR)	Average time to respond to and resolve incidents	< 8 hours	Incident management system	Monthly	Incident Response Manager
Security Incident Impact	Average business impact of security incidents (downtime, data loss, cost)	Trend downward	Incident impact assessment	Quarterly	CISO

Vulnerability Management Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Vulnerability Scan Coverage	Percentage of assets scanned for vulnerabilities	100%	Vulnerability scanner	Weekly	Vulnerability Management Team
Critical Vulnerability Remediation Time	Average time to remediate critical vulnerabilities	< 7 days	Vulnerability management system	Monthly	IT Security
High Vulnerability Remediation Time	Average time to remediate high vulnerabilities	< 30 days	Vulnerability management system	Monthly	IT Security
Vulnerability Backlog	Number of open vulnerabilities by severity	Trend downward	Vulnerability tracking system	Monthly	Vulnerability Manager
Patch Compliance Rate	Percentage of systems with current security patches	> 95%	Patch management system	Weekly	IT Operations
Zero-Day Response Time	Time to assess and mitigate zero-day vulnerabilities	< 24 hours	Incident response logs	Per occurrence	Security Team

Security Awareness & Training Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Training Completion Rate	Percentage of required staff completing security training	100%	Learning management system	Quarterly	Training Manager
Training Timeliness	Percentage of staff completing training by due date	> 95%	LMS reports	Quarterly	HR/Training
New Hire Training Completion	Percentage of new hires completing security orientation within 30 days	100%	LMS reports	Monthly	HR
Phishing Simulation Click Rate	Percentage of users clicking simulated phishing emails	< 5%	Phishing simulation tool	Quarterly	Security Awareness Team
Phishing Reporting Rate	Percentage of users reporting simulated phishing emails	> 80%	Phishing simulation tool	Quarterly	Security Awareness Team
Security Awareness Score	Average score on security awareness assessments	> 85%	Assessment tool	Annually	Training Manager

Network Security Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Intrusion Attempts Blocked	Number of intrusion attempts blocked by IDS/IPS	Track trends	IDS/IPS logs	Daily/Monthly	Network Security
Malware Detection Rate	Number of malware instances detected and blocked	Track trends	Antimalware systems	Daily/Monthly	Endpoint Security Team
Malware Infection Rate	Number of systems infected by malware	Zero	Endpoint security reports	Monthly	Endpoint Security Team
Network Segmentation Compliance	Percentage of network segments properly configured and isolated	100%	Network architecture review	Quarterly	Network Security
Firewall Rule Reviews	Percentage of firewall rules reviewed and validated	100% annually	Firewall management system	Annually	Network Security
DMZ Security Posture	Compliance score for DMZ security controls	100%	Security configuration assessment	Quarterly	Network Security

Backup & Recovery Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Backup Success Rate	Percentage of scheduled backups completed successfully	> 99%	Backup system reports	Daily	Backup Team
Backup Verification Rate	Percentage of backups verified/tested	100% of critical systems monthly	Backup verification logs	Monthly	Backup Team
Recovery Time Objective (RTO) Compliance	Percentage of systems meeting RTO targets during tests	100%	DR test results	Annually	Business Continuity Manager
Recovery Point Objective (RPO) Compliance	Percentage of systems meeting RPO targets	100%	Backup schedules review	Monthly	Backup Manager
Disaster Recovery Test Success	Percentage of DR tests meeting success criteria	100%	DR test reports	Annually	Business Continuity Team

Compliance & Audit Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Internal Audit Completion	Percentage of planned internal audits completed on schedule	100%	Audit schedule tracking	Quarterly	Internal Audit
Audit Findings Closure Rate	Percentage of audit findings closed within due date	> 95%	Audit tracking system	Quarterly	Information Security Manager
Control Effectiveness Score	Average effectiveness rating of ISMS controls	> 85%	Control assessment results	Annually	CISO
Policy Compliance Rate	Percentage of users compliant with security policies	> 95%	Compliance monitoring tools	Quarterly	Compliance Team
Non-conformity Rate	Number of non-conformities identified per audit	Trend downward	Audit reports	Per audit	Internal Audit
Regulatory Compliance Status	Percentage of applicable regulations fully complied with	100%	Compliance assessments	Annually	Compliance Officer

Physical Security Metrics

Metric	Definition	Target	Measurement Method	Frequency	Owner
Unauthorized Access Attempts	Number of unauthorized physical access attempts	Zero	Physical access control logs	Daily	Facilities Security
Visitor Management Compliance	Percentage of visitors properly logged and escorted	100%	Visitor management system	Monthly	Reception/Security
Physical Access Review Completion	Percentage of physical access rights reviewed on schedule	100%	Access review records	Quarterly	Facilities Manager
CCTV System Uptime	Percentage of time CCTV systems operational	> 99.5%	CCTV monitoring system	Monthly	Facilities Security
Environmental Control Effectiveness	Percentage of time environmental controls (temp, humidity) within acceptable ranges	> 99%	Environmental monitoring systems	Monthly	Facilities Operations

ISMS Objectives & Strategic Metrics

Objective	Key Performance Indicator	Target	Current	Status	Owner
Reduce Security Incidents	Month-over-month reduction in security incidents	-10% MoM	[Current value]	[On/Off Track]	CISO
Improve Detection Capability	Mean Time to Detect (MTTD)	< 1 hour	[Current value]	[On/Off Track]	SOC Manager
Enhance Security Awareness	Phishing simulation click rate	< 5%	[Current value]	[On/Off Track]	Security Awareness Lead
Achieve Certification	ISO 27001 certification audit findings	Zero major findings	[Current value]	[On/Off Track]	Information Security Manager
Maintain High Availability	System uptime for critical systems	> 99.9%	[Current value]	[On/Off Track]	IT Operations Manager
Reduce Vulnerability Exposure	Average time to remediate critical vulnerabilities	< 7 days	[Current value]	[On/Off Track]	Vulnerability Manager

Metrics Dashboard Template

Monthly Security Dashboard

Reporting Period: [Month Year] Prepared by: [Name] Date: [Date]

Executive Summary

Overall security posture: [Green/Amber/Red]
Key achievements this month
Critical issues requiring attention
Trending concerns

Key Metrics Status

Category	Metric	Target	Actual	Status	Trend
Incidents	Total incidents	Decreasing	[#]	[Status]	[↑/↓/→]
Incidents	MTTD	< 2 hours	[Time]	[Status]	[↑/↓/→]
Vulnerabilities	Critical vuln remediation	< 7 days	[Days]	[Status]	[↑/↓/→]
Access	Failed logins	< 3/user/day	[#]	[Status]	[↑/↓/→]
Training	Completion rate	100%	[%]	[Status]	[↑/↓/→]
Backups	Success rate	> 99%	[%]	[Status]	[↑/↓/→]
Phishing	Click rate	< 5%	[%]	[Status]	[↑/↓/→]
Compliance	Audit findings open	Decreasing	[#]	[Status]	[↑/↓/→]

Detailed Analysis

[Detailed explanation of significant changes, concerns, and achievements]

Actions Required

[Action item 1] - Owner: [Name] - Due: [Date]
[Action item 2] - Owner: [Name] - Due: [Date]

Implementing Your Metrics Program

Step 1: Select Relevant Metrics

Choose 15-25 metrics that align with your risks, objectives, and stakeholder needs.

Step 2: Define Baselines

Establish baseline measurements for each metric before setting targets.

Step 3: Set Realistic Targets

Set achievable targets based on industry benchmarks, past performance, and organizational goals.

Step 4: Automate Collection

Automate data collection wherever possible to ensure consistency and reduce manual effort.

Step 5: Create Dashboards

Build visual dashboards that make metrics easy to understand and act upon.

Step 6: Establish Review Process

Schedule regular metric reviews at appropriate levels (operational, tactical, strategic).

Step 7: Take Action

Use metrics to drive decisions, improvements, and resource allocation.

Step 8: Refine Over Time

Periodically review your metrics program and adjust metrics that aren't providing value.

Best Practices

Do:

Focus on metrics that drive action
Make metrics visible and accessible
Automate data collection
Review metrics regularly
Use metrics to tell a story
Benchmark against industry standards
Show trends over time

Don't:

Track metrics you won't use
Set unrealistic targets
Ignore adverse trends
Use metrics to punish people
Over-complicate measurement
Focus only on lagging indicators
Collect data without analyzing it

Next Lesson: We'll design a comprehensive Internal Audit Program to systematically assess your ISMS effectiveness.