The use of metrics to manage enterprise security risks: Understanding, evaluation and persuasion

Metrics drive business decisions and behaviour. Properly developed using psychometric principles, metrics provide a solid rationale for senior management to make prudent decisions about organisational growth as well as facilitating the assessment of internal policies and programmes. Until recently, there has been little research on the development of effective performance metrics, especially in the security field. The American Society for Industrial Security International (ASIS International) provided funding for an extensive study into the development of metrics for the security profession. The study included an online survey, telephone interviews, and a review of the literature and best practices of past research on metrics. Based on the data collected, a security metrics evaluation tool was developed, incorporating core psychometric principles and reflecting both operational and strategic corporate requirements. Finally, guidelines were developed for presentation to senior executives.