What Should You Actually Measure? 6 Metrics That Matter

Last week we made the case that "we haven't had a breach" isn't proof your program is working. This week: what should you actually be tracking?

You don't need a complex dashboard on day one. Start with these six:

1. Phishing test results — how many people click simulated attacks?

2. Security training completion — are employees actually participating?

3. Policy acknowledgments — who has signed off on key policies?

4. Patch/update timelines — how long does it take to close a critical fix?

5. Audit findings — what did the last audit turn up, and is it resolved?

6. Risk trends — are your top risks shrinking in likelihood or impact?

If your program is aligned to a framework like CIS Controls or NIST CSF, use that framework to benchmark progress across categories. It turns a random list of numbers into a structure.

Think of these like vital signs at a checkup. Your doctor doesn't just ask "do you feel healthy?" and call it done. They check blood pressure, heart rate, and a handful of other numbers, because a few honest numbers tell a truer story than a feeling does.

This week's takeaway: You don't need all six on day one. Pick two or three and start tracking. The list grows from there.

Curious how these metrics fit into a full year-round program? Sign up for our newsletter on the landing page and get a full month's preview of our Information Technology Security Program implementation process. https://itsppreview.cygentis.com