Global Director of Information Security at Mauser Packaging Solutions

Metrics and KPIs are the hallmark of any mature program (regardless of the program). While these two indicators are not specific to IT or sub-discipline, they can help tell the story of how a program operates. Let us start with a few definitions to level set.

A "metric" is a quantifiable measurement or standard used to assess, compare, and evaluate various aspects of a system, process, or phenomenon. For example, a company identified and blocked 4,000 malicious emails in the prior month. In the next month, they identified and blocked 5,000 malicious emails. This metric tells the story of an increase of 25%. As this percentage continues to grow, leadership has an opportunity to begin taking their email security to the next level.

“Defining a metric and KPI program is not difficult. It is always best to start with what you have.”

A "KPI" (Key Performance Indicator) is a specific metric used to measure the performance of an organization/team toward achieving its goals and objectives. For example, a KPI may be the goal of blocking 100% of the malicious emails that are sent to your company. For the previous month, you stopped 4,000 messages. For the next month, you blocked 5,000. Month over month, you continue to meet the objective of blocking 100% of the malicious email. But what happens when the number of malicious emails exceeds the capability of your email security? When your KPI for this objective drops below 100%, then this indicates that you have a deficiency in your program that needs attention.

Where do I start?

Defining a metric and KPI program is not difficult. It is always best to start with what you have. You likely patch systems regularly. Hopefully, you have some email security and are doing some vulnerability assessments. Most companies probably have a firewall with some form of Intrusion Detection or Intrusion Prevention.