Governance and Performance Indicators for the Security Program
Measuring whether governance fulfills its purpose
Governance indicators measure something different from purely operational indicators such as incident response time; they focus on whether decision-making structures are working as they should, for example the percentage of committee meetings held as planned, the average time it takes leadership to approve an escalated risk decision, or the level of achievement of the strategic objectives defined in the year's security plan. In addition, program performance indicators evaluate whether the investment and initiatives carried out are producing the expected result in terms of real risk reduction. In practice, a mature program doesn't only report technical indicators such as the number of vulnerabilities closed, but also these governance indicators, because a program can show good operational results while its governance structures work poorly, and that deficiency is only detected with metrics specifically designed to measure it instead of assuming it's implicit in the technical results.