{"id":34521,"date":"2026-08-14T14:07:22","date_gmt":"2026-08-14T12:07:22","guid":{"rendered":"https:\/\/sits.com\/?p=34521"},"modified":"2026-08-19T15:05:01","modified_gmt":"2026-08-19T13:05:01","slug":"cybersecurity-kpi-making-security-measurable","status":"publish","type":"post","link":"https:\/\/sits.com\/en\/blog\/cybersecurity-kpi-making-security-measurable\/","title":{"rendered":"Auditability as the Cybersecurity KPI"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text]New cybersecurity regulations, particularly those introduced through the NIS2 Directive<\/a>, require the effective implementation<\/strong> of risk management measures. The effectiveness of the cybersecurity practices achieved must be auditable and explicitly demonstrated throughout the supply chain<\/a>.<\/p>\n

In practice, this is best achieved through traceable Key Performance Indicators<\/strong> (KPIs), as an Information Security Management System<\/a> (ISMS) must be managed using criteria that demonstrate whether defined objectives have been achieved. At the same time, a higher maturity level can only be reached if meaningful KPIs are identified, measured as automatically as possible, and monitored regularly. But where should organizations start to avoid getting hopelessly lost in a multitude of individual metrics?<\/p>\n

The importance of these metrics is currently increasing. Regulatory requirements are having a greater impact on security processes, governance structures, and technology decisions. Organizations therefore face the challenge of implementing security measures while also being able to demonstrate their effectiveness to customers, regulators, and business partners. The question is therefore becoming less and less frequently, \u201cAre measures in place?\u201d and increasingly, \u201cCan we prove their effectiveness<\/a>?\u201d.[\/vc_column_text]

<\/div>\n

Defining Cybersecurity KPIs correctly: What really matters<\/h2>[vc_column_text]Experience shows that meaningful KPIs can only be developed if the following approach is taken into account:<\/p>\n
    \n
  1. Only select something as a metric if it provides a clear indication<\/strong> of whether important objectives have been achieved and can be measured objectively, meaning with reproducible results.<\/li>\n
  2. Only define a metric if measuring it actually provides feedback on required corrective actions<\/strong>.<\/li>\n
  3. When selecting metrics, consider who the recipient<\/strong> of the metric will be and whether it will provide that recipient with a relevant gain in insight<\/strong>.<\/li>\n
  4. A metric is only credible if the recipient has the impression that its collection<\/strong> could be reviewed,<\/strong> if necessary, potentially by an appointed third party, and that the reported value could therefore be verified<\/strong>.<\/li>\n<\/ol>\n

    A KPI is ultimately created by deliberately consolidating metrics, for example through the correlation or combination of different measured values.<\/p>\n

    In practice, however, organizations often collect too many metrics and lose sight of the bigger picture. What matters is not the number of metrics, but their relevance. A KPI should always be able to answer a specific question, such as whether critical systems are sufficiently protected, whether security measures remain effective over time, or whether existing risks have actually been reduced. Only then does it provide reliable value for management and operational teams.[\/vc_column_text]

    <\/div>\n[\/vc_column][\/vc_row][vc_row custom_background_class=\"gradient-up\"][vc_column]

    ISO 27001: Requirements for Cybersecurity KPIs and measurability<\/h2>[vc_column_text]According to Clause 6.1.1 of ISO\/IEC 27001<\/a>, organizations must ensure that their ISMS<\/a> achieves its intended outcomes. These outcomes must be defined in measurable terms in accordance with Clause 6.2, and their achievement must be monitored. Organizations must determine how results will be evaluated at the planning stage. ISMS processes are managed based on defined criteria, making it possible to trust that the processes are being carried out as planned.<\/p>\n

    This is therefore about trust<\/strong>. More specifically, it is about confidence that the requirements and expectations of interested parties are being reliably fulfilled through the ISMS<\/a>. This includes legal and regulatory requirements as well as contractual obligations. Or to put it another way: it is about confidence that relevant cybersecurity requirements are being fulfilled through the ISMS in a traceable and transparent manner<\/strong>.<\/p>\n

    Clause 9.1 of the standard also requires monitoring and measurement methods to produce valid, comparable, and reproducible results. This requires documented information, meaning documentation that is controlled and approved.<\/p>\n

    This aspect is becoming increasingly important as new regulatory requirements emerge. Documented evidence is no longer used exclusively for internal audits<\/a>. It is increasingly becoming the basis for compliance assessments<\/a>, supplier assessments<\/a>, and regulatory evidence requirements<\/a>. The ability to collect meaningful metrics in a transparent and traceable way is therefore becoming a central component of modern security governance.[\/vc_column_text]

    <\/div>\n

    NIS2 requirements: Which Cybersecurity KPIs do organizations need?<\/h2>[vc_column_text]To manage risks<\/strong> to the security of network and information systems:<\/p>\n