IT Security Management

Information security is a management activity within the corporate governance

framework, which provides the strategic direction for security activities and
ensures objectives are achieved. It further ensures that the information security
risks are appropriately managed and that enterprise information resources are
used responsibly. The purpose of ISM is to provide a focus for all aspects of IT
security and manage all IT security activities.

Suggested KPIs IT Security Management

+ve Positive KPI (high value is desirable)

-ve Negative KPI (low value is desirable)

Key Performance Indicator (KPI) Definition

+ve Decrease Reported Incidents
+ve Decrease in impact of security incidents
+ve Increase in SLA conformance
Number of Implemented Preventive Measures
Implementation Duration
Number of Major Security Incidents
Number of Security-Related Service Downtimes
Number of Security Tests
Number of Identified Shortcomings during Security
Tests
Percentage decrease in security breaches reported to the
Service Desk
Percentage decrease in the impact of security breaches
and incidents
Percentage increase in SLA conformance to security
clauses.
Number of preventive security measures which were
implemented in response to identified security threats
Duration from the identification of a security threat to
the implementation of a suitable counter measure
Number of identified security incidents, classified by
severity category
Number of security incidents causing service
interruption or reduced availability
Number of security tests and trainings carried out
Number of identified shortcomings in security
mechanisms which were identified during tests