Security Metrics Guide for Information Technology Systems

This document provides guidance on how an organization, through the use of metrics, identifies
the adequacy of in-place security controls, policies, and procedures. It provides an approach to
help management decide where to invest in additional security protection resources or identify
and evaluate nonproductive controls. It explains the metric development and implementation
process and how it can also be used to adequately justify security control investments. The
results of an effective metric program can provide useful data for directing the allocation of
information security resources and should simplify the preparation of performance-related
reports.