Question

A newly appointed information security manager wants to establish a metrics program to demonstrate the value of security investments to executives. The team has access to a large volume of operational data from various tools but has never formally reported metrics. What should the manager do FIRST before collecting and reporting any metrics?

Accepted Answer

Define the objectives the metrics are intended to support and the questions each metric must answer

Answer

Deploy a centralized dashboard that aggregates all available tool data automatically

Answer

Benchmark the organization's data against published industry averages

Answer

Select the metrics that are easiest to extract from existing tools to ensure quick delivery