Which cybersecurity metrics do you currently use with your board?

Security & GRCBoard Engagement
3.2k viewscircle icon3 Comments
Sort by:
Chief Information Security Officer3 days ago

Business Unit Contributions: All indicators are provided by individual business units, highlighting varying levels of cybersecurity maturity across the organization. This comparative view serves as a guide for prioritizing remediation efforts.

• External Threats: Overview of threats related to our external environment.

For each threat, the dashboard includes readiness indicators for:
    • Protection
    • Response
    • Recovery

• Internal Key Risk Indicators (KRIs):
    • Vulnerabilities
    • Endpoint protection (servers, workstations, and network)
    • Database security
    • Third-party risk
    • System hardening
    • Patch Management 

• Business-Critical Application Vulnerabilities
• Cultural Risk: Human factor and security awareness
• Penetration Test Results
• NIST Framework Adherence
• External Risk Score: Based on SecurityScorecard
• Critical and High Severity Incidents
• Cybersecurity Strategic Plan: Execution status and results
• Audit Findings and Outcomes

Director of Information Security in Healthcare and Biotech6 months ago

We focus on rolled up risks, phishing, vulnerability management and program risks. We try to reduce noise as much as possible, but they do creep in as board security awareness and desire for the right level of metrics is being baselined. 

VP of IT in Manufacturing10 months ago

I suggest to look into the Gartner ODMs (Outcome-driven metrics) for Cybersecurity. We have adapted these 16 metrics, and one of the benefits is that it is possible to communicate them in an meaningful way for top management.
Other benefits are that they come as a pre-defined framework and that you can get benchmarks that at least in our case answers the the first question from leadership: How are others doing?

Lightbulb on2

Content you might like

On a scale of 1-5, how would you rate your organization’s ability to successfully protect your organization's operational network (OT) and IT network from a cyber attack?

1. We are not at all prepared.3%

2. We are somewhat prepared.35%

3. We are moderately prepared.21%

4. We are generally prepared.33%

5. We are highly prepared.6%

View Results

As an IT executive, how much would you like to invest in early-stage startups per year?

$10k - $50k32%

$50k - $100k49%

$100k+9%

No thanks, I'm killing it in the stock market8%

View Results

What do you do to recover quickly from early missteps in a new role? How can you keep initial mistakes from coloring perceptions when you’re still trying to establish your reputation at a new organization?

Based on your past experiences with starting a new position, what sorts of quick wins tend to have the greatest impact in terms of building up your credibility with stakeholders?

Read More Comments