Enhancing cybersecurity metrics: CISO strategies

Structuring cybersecurity metrics and insights for the board

To effectively communicate cybersecurity risks and the organization’s security posture, CISOs should provide the board with regular, structured updates. These updates should offer a clear, ongoing assessment of the organization’s cybersecurity health and emerging threat landscape. The insights below are illustrative examples.

• Intelligence-driven assessment of external threat landscape: Correlate intelligence-driven assessments of the external threat landscape, including emerging threats, to the potential impacts on internal business operations. The key question to answer is: What matters and why?
  • The rise of AI-driven cyber attacks heightens the likelihood of attackers gaining initial access to environments, leading to severe business interruptions. Ransomware or destructive attacks can result in significant financial losses and data breaches, including sensitive R&D and personally identifiable information (PII), eroding trust and causing lasting reputational damage.
• Risk appetite alignment: Percentage of key risks within business-approved thresholds and risk tolerance levels. This includes a clear understanding of what is material to the business and should align with a holistic resiliency strategy resulting in safeguarding that the required enterprise protection capabilities are in place.
  Illustrative metrics examples relate to cyber and operational risk management such as risk appetite indicator (RAI) scores for each business unit or division:
  • For example, if an organization or business unit defines its risk appetite as tolerating no cyber risks that could lead to a financial loss exceeding $50 million (classified qualitatively as above “low”), it is crucial to maintain a prioritized list of top business concerns and risks. This list should be regularly analyzed to evaluate whether the estimated probability and potential loss magnitude of identified risks could breach this threshold. For instance, one significant risk might be a “disruption to customer products due to a ransomware attack, resulting in loss of availability.” In this case, the organization would need to assess the likelihood of such an attack and the potential financial impact to determine if it aligns with their risk appetite.
• Compliance and regulatory status: Alignment with frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization 27001 (ISO 27001), System and Organization Controls 2 (SOC 2) framework, industry-specific regulatory requirements and SEC disclosure requirements. Examples of metrics include conformance to requirements for pertinent regulations.
• Risk mitigation progress: It is imperative to demonstrate the progress of key investments intended to reduce risk exposure, typically by way of performing periodic independent assessments of the maturity of your cyber program, with read-outs made directly to the board. Cyber metric examples may include the percentage of major risk mitigation efforts on track, along with additional projects that could be funded and their projected risk reduction impact. This includes linking mitigation efforts to overall business risk posture, demonstrating how investments align with strategic objectives and reduce exposure to critical threats. This helps manage risk within appetite and navigate emerging threats. 
• Value-centric operational cybersecurity metrics: Traditional operational key performance risk indicators (KPIs) and key risk indicators (KRIs), while informative, should not be the centerpiece of cyber risk discussions at the strategic level. However, including a few operational metrics in an appendix can be valuable for deeper dives or to address specific stakeholder questions. The primary focus should be on designing operational cybersecurity metrics that are aligned to business value and support tactical decision-making. These metrics should help translate technical performance into meaningful insights that inform action, demonstrate impact and reinforce the cybersecurity function’s role as a business enabler. We will explore this topic, value-centric operational cybersecurity metrics, in greater depth in an upcoming thought leadership piece. For now, the visual below illustrates a framework for structuring and communicating value-centric cybersecurity measurements, rooted in business strategy and informed by real-world inputs.