Begin with the decisions the board must make
A useful measure helps someone decide, challenge or allocate. Start with the organisation’s critical services, material risk scenarios and current improvement commitments. The board may need to understand whether exposure is changing, whether management actions are on track, whether recovery expectations are credible and which unresolved decisions require authority or funding.
Avoid building the report from whatever a tool can count. Alert totals, blocked attacks and training completions can provide operational context, but they rarely explain whether a material service is safer. Each metric should state its purpose, owner, data source, calculation, limitations and the decision it is intended to support.
Balance exposure, performance and resilience
Use a small portfolio of measures. Exposure indicators might include critical services without phishing-resistant administrator authentication, unsupported internet-facing systems or high-impact supplier access without review. Performance measures can show remediation ageing, exception trends and control coverage. Resilience measures should include restoration results, exercise actions and evidence availability.
Pair leading and lagging indicators. Incidents and losses describe outcomes after conditions combined; coverage and test results can show whether safeguards are changing beforehand. Present the population and scope with percentages. “Ninety per cent protected” means little if the unprotected ten per cent contains the most important administrative accounts.
Make uncertainty and exceptions visible
Security data is incomplete. Define where inventory, supplier information, logging or validation is missing, and show the effect on confidence. A stable metric may reflect an unchanged environment or an unobserved one. Trends should use consistent definitions, and any change in source or calculation should be explained.
Exceptions are management decisions, not data-cleaning problems. Report material exceptions with owner, rationale, compensating safeguards and review date. Separate work that is delayed by dependency from risk that has been explicitly accepted. This prevents an attractive dashboard from hiding decisions that need leadership attention.
Connect every measure to action and review
A measure needs thresholds or interpretation. Define which movement triggers investigation, escalation, funding or acceptance. Include a concise narrative that explains cause and consequence; numbers without context can invite the wrong intervention. Keep technical drill-down available so management can challenge how the conclusion was reached.
Retire measures that no longer support a decision and add measures when architecture or risk changes. Periodically test the reporting chain from source to board paper. The goal is not a permanent score of security. It is a dependable view that helps leaders ask better questions, assign responsibility and verify whether investment changed the intended risk.
What to do next.
- ✓Tie every metric to a decision or risk question.
- ✓Show scope, population, owner and data limitations.
- ✓Balance exposure, control performance and resilience.
- ✓Highlight critical exceptions and confidence gaps.
- ✓Define thresholds and the action each threshold triggers.
- ✓Review and retire measures as the environment changes.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.