Cybersecurity Organization Structure ◾ 167

many departments to define the metrics to be collected, collect the metrics on a periodic basis (monthly minimally for operational metrics), validate the metrics, and determine the “meaning” of the metrics. Selected metrics of interest can then be provided to the board.

EDWARD MARCHEWKA: SECURITY METRICS TO MEASURE PROGRAM EFFECTIVENESS

Director, Information and Technology Services, Gift of Hope

Metrics help to tell a story to the right audience in terms they will understand. We, CISOs, have different audience members that include the board, execu-tives, auditors/regulators, and engineers. As we tell each of these audiences the story of information security, it must be appropriate for our audience’s level of understanding and their background keeping in mind they ask of or from them.

◾ The board is strategic, and we are asking for resources. The board, usu-ally, receives an aggregated total score and maturity score, with average risk rating. This tells them where we are and how tight the controls are. We can use this to build a road map too and show how the resources are helping to move the needle.

◾ Executives need actionable information, usually, by subject area, and we need to answer their ask, “What’s in it for me?” Executives need to see how the security program is affecting them. We need to aggregate by topics they care about. For example, the CMO might care about integrity and reputation, to address concerns of report accuracy and potential reputation damage. I aggregate my tactical metrics around six key business indicators: confidentiality, integrity, availability, human resources, finance, and reputation.

◾ Auditors/regulators need to know we know about our environment and that we are doing something about it. This is the blend of the aggre-gated and tactical metrics. They may understand that a program exists with the tactical metrics but may also want to see the details.

◾ Engineers need the details, and we are going to ask them to fix some-thing. With the engineers, we can show them detailed tactical metrics such as patch cycle times or incident mean time to resolution.

NIST and Center for Internet Security (CIS)have great listings of tactical metrics with parameters for different levels of risk. From there, you can tie the results to specific technologies. Your metrics are not a burden to the job but should be a tool to help you tell a better story.