ISMS metrics

ISMS metrics – often referred to as security KPIs – provide the quantitative basis for measuring whether an information security management system actually works. Clause 9.1 of ISO/IEC 27001:2022 requires an organisation to determine what needs to be monitored and measured, by which methods, when the measurement is taken and evaluated, and who is responsible for each step; the results must be retained as documented information. A useful distinction is between performance measures, which describe how the ISMS is operated (coverage rates, processing times), and effectiveness indicators, which show whether a control genuinely reduces risk. ISO/IEC 27004 supplies the methodology, separating base measures, derived measures and the indicators built from them, each with a target value and a threshold.

Meaningful metrics come from what the organisation wants to steer, not from whatever a tool happens to export. A sound metrics set is therefore derived from the protection objectives, the risk assessment and the agreed risk treatment measures; it can be collected reproducibly from existing sources; and every measure has a named owner and a defined target range. Proven examples include adherence to patch deadlines for critical vulnerabilities, the share of open vulnerabilities past the agreed remediation window, mean time to detect and mean time to contain security incidents, multi-factor authentication coverage, the click rate in phishing simulations, the proportion of risk treatment actions closed on time, and the number of overdue audit findings. Pure activity counts with no link to risk – the volume of blocked spam, for instance – fill report pages but give management nothing to decide on.

Metrics only fulfil their purpose once they reach the governing body. Under clause 9.3 of ISO/IEC 27001:2022, monitoring and measurement results, audit results, the status of corrective actions and feedback from interested parties are mandatory inputs to the management review, which must produce documented decisions on improvements and resources – closing the loop of the PDCA cycle. The EU NIS2 Directive (EU) 2022/2555 adds regulatory weight: Article 21(2)(f) explicitly calls for policies and procedures to assess the effectiveness of cybersecurity risk management measures, and Article 20 makes management bodies personally responsible for approving and overseeing them. Germany implements this through the NIS2 implementation act (NIS2UmsuCG), which transfers the obligations into the recast BSIG; because the German transposition was delayed and parts of it have been refined since, the precise point at which individual duties and registration procedures apply should always be verified against the current statute and the BSI's published guidance. The practical consequence is that metrics are not an end in themselves – they are the evidence that management is in a position to exercise its oversight duty at all.