thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Security Metrics

Quantifiable measurements used to track security program performance, risk, and control effectiveness.

Definition

Good security metrics are specific, measurable, attainable, repeatable, and time-dependent, and are tailored to the audience: technical metrics for operations, risk and business metrics for executives. Examples include patch latency, phishing click rate, and percentage of critical assets covered by EDR. NIST SP 800-55 provides guidance on performance measurement.

Example

The board receives a metric showing the percentage of revenue-critical systems meeting baseline configuration.

Exam tip

For executive audiences, choose business-aligned risk metrics over raw technical counts.

Related terms