사이버보안 GRC 15개 항목
Security Metrics & KPI Program Review
이 체크리스트는 영어로 제공됩니다.
Reviews a security metrics and KPI program for measurement definition, data quality, operational and risk metrics, and reporting to leadership aligned to NIST SP 800-55 and ISO 27004.
NIST 800-55ISO 27004NIST 800-53
무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.
Program Definition
- Are measurement objectives tied to business and security goals documented? *
- Does each metric have a defined owner, formula, and data source? *
- Are targets or thresholds defined for each KPI? *
- Is a review cadence defined for the metrics program?
Operational Metrics
- Are detection and response metrics (MTTD, MTTR) tracked? *
- Is vulnerability remediation performance measured against SLA? *
- Are patch and system-hardening compliance rates tracked? *
- Is security awareness/phishing-simulation performance measured?
Risk & Coverage Metrics
- Is control coverage measured against a framework baseline? *
- Are open risks and their treatment status quantified? *
- Is third-party/vendor risk posture measured and trended?
Reporting & Use
- Are metrics reported to executives and the board in business terms? *
- Are trends shown over time rather than point-in-time snapshots? *
- Are metrics used to drive decisions and resource allocation? *
- Is data quality for metrics periodically validated?
Security Metrics & KPI Program Review 체크리스트 전체 다운로드
인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.