KRIs and KPI for Cyber Security

The report proposes a practical set of cyber security Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) that are easy to measure and can be combined into a scorecard for both IT and corporate management. It positions KRIs as a missing counterpart to well-established performance dashboards: KPIs show how well processes achieve goals, while KRIs quantify risk in terms of likelihood and impact, enabling “management by risk” (management by exception). A key aim is to tie operational IT measures back to strategic business requirements, while demonstrating progress toward widely used standards such as ISO/IEC 27001 and the NIST Cybersecurity Framework.

Hybrid IT and digital transformation increase cyber security complexity because responsibility is shared across customers, cloud service providers, and other suppliers; misunderstandings and service-user failures frequently drive incidents. To address this, the report frames hybrid cyber security around six common elements that must be applied consistently across delivery models: governance, standards, management processes, risk management, technical controls, and audit. It then maps recommended KRIs/KPIs to the NIST core functions—Identify, Protect, Detect, Respond, Recover—and relates them to ISO/IEC 27001 controls.

Key indicators include asset inventory and ownership, asset classification by sensitivity and business criticality, governance and framework maturity, formal risk assessment with a risk register, vulnerability management coverage and remediation, supply chain risk processes and independent service certification, identity lifecycle integration, employee screening, entitlement management depth, privileged and orphan account minimization, strong authentication adoption, zero trust networking coverage, cloud access control (including CASB), DLP coverage, encryption at rest and in transit, change management reach, backup/restoration testing, anti-malware coverage, central logging with correlation, SOC capability (internal or outsourced), and tested incident response and recovery planning. The recommended implementation approach is lean: start small, choose valid/influenceable/easy-to-collect metrics, define thresholds and control actions, and expand based on proven success within an integrated risk management model.

• Key Goal Indicators measure what must be accomplished, KPIs measure process performance toward goals, and KRIs measure risk in terms of probability and impact.
• The NIST Cybersecurity Framework was developed in the USA based on Presidential Executive Order 13636 to reduce cyber risks to national critical infrastructure.
• The NIST Framework Core is organized into five functions: Identify, Protect, Detect, Respond, and Recover.
• A hybrid cyber security architecture is described as requiring six common elements: governance, standards, management processes, risk management, controls, and audit.
• Asset management indicators include the percentage of assets inventoried and the percentage with identified owners, with a target of 100%.
• Vulnerability management indicators include the percentage of assets regularly scanned and the percentage of vulnerabilities removed, with a target of 100%.
• Privileged account management is measured by the percentage of unmanaged privileged accounts, with an optimum target of 0%.
• Orphan accounts are defined as accounts not associated with a specific known person or entity, with an optimum target of 0%.
• Central logging and anomaly detection targets collecting and correlating 100% of relevant event data from multiple sources in a single place.
• Incident response and incident recovery are treated as separate processes, each requiring a plan that exists and is regularly tested.

• “The key benefit of using this approach is that performance at the IT process level can be related back to the strategic business requirements.”
• “Kuppinger Cole strongly recommends using KRI concepts as management tool within today’s hybrid IT for cyber security.”
• “You can’t protect what you don’t know you have.”
• “An ounce of prevention is worth a pound of cure.”
• “The users of systems are the first line of defense against cyber-attacks.”
• “In the hybrid IT service delivery model, the organization using the service is always ultimately responsible for their data wherever it is held and however it is processed.”
• “Cyber security depends upon being able to detect anomalies and monitor performance against specified controls.”
• “It is not enough to know that your organization is under a cyber-attack it is essential to be able to respond.”
• “It is no longer a case of if an organization will be attacked but when.”
• “Design resilience in from the ground up”