A Collection of Key Risk Indicators for

Information Security
& Technology

w w w.opsdog.com
info@opsdog.com
844.650.2888
You can’t
secure
what you
can’t
see...
All improvement
begins with
measurement.
That’s what this book of essential
Key Risk Indicators is all about.

It will help you pinpoint areas in need

of attention. It will help you to baseline,
to benchmark, and to get better.

We would like to help.

Did you know that OpsDog has helped

the world’s leading enterprises to
identify and improve their essential
KRIs without any new technology?

Think of that as you page through this book.

Then call 844.650.2888 or visit

www.OpsDog.com.

THANK YOU!
Table of Contents

Information Security &

Technology Key Risk Indicators
Information Security������������������������������ 3
Data Integrity Risks��������������������������������������������������������������������������� 5
Data Privacy Risks�������������������������������������������������������������������������������8
External Threats�����������������������������������������������������������������������������������8
Internal Threats���������������������������������������������������������������������������������� 11

Information Technology ���������������������21

IT Development Risks���������������������������������������������������������������������23
IT Planning & Performance �������������������������������������������������������� 26
Management Risks
Technology Infrastructure Risks���������������������������������������������� 30
Telecommunications & ����������������������������������������������������������������40
Connectivity Risks

This content may not be copied, distributed, republished, uploaded, posted

or transmitted in any way without the prior written consent of OpsDog, Inc.

1
Information
Security
• Data Integrity Risks
• Data Privacy Risks
• External Threats
• Internal Threats

3
Information Security
Data Integrity Risks
1. Percentage of Systems With
Monitored Event and Activity Logs
Definition: The number of systems with
event and activity logs that are monitored as a
percentage of total systems managed by the
organization.
Rationale: This metric measures the
percentage of systems with monitored event
and activity logs. Monitored logs result
in faster alerts to unusual system activity
(attacked, capacity events). Such logs may be
also be able to reveal a timeline of an attack
and unique identifying information about an
attacker. For example, a log of alterations
to core system files can be monitored and
correlated with other logs of user events to
determine which user took illegal action on a
network.
Formula: (Number of systems with monitored
logs) / (Total number of systems)
Related KRIs/KPIs: Number of Expired
Certificates Within the Network, Number of
Failures to Properly Send Logs to Central Log
Management System, Number of Instances
Where Central Log Management System
Exceeded Storage Availability Requirements
2. Number of Failures to Properly
Send Logs to Central Log
Management System
Definition: The number of times within a
measurement period that system logs go
unreported to a central log management
system.
Rationale: This metric measures the
adherence to policy within an IT system to
a central log archive system. Logs may be
archived or serialized into a database format
by a third-party service for future analysis.
Failure to adhere to such a policy will result in
missing information and will undermine future
threat responses.
5
Formula: Number of non-compliant logs
during a measurement period
Related KRIs/KPIs: Percentage of Systems
With Monitored Event and Activity Logs,
Number of Instances Where Central Log
Management System Exceeded Storage
Availability Requirements
3. Number of Instances Where
Central Log Management System
Exceeded Storage Availability
Requirements
Definition: The number of times within a
measurement period in which the central log
management system ran out of storage space,
resulting in logs not being properly recorded.
Rationale: This metric measures the number
of times within a measurement period in
which too many system logs were generated.
Numbers of logs that overflow the ability to
store or analyze them could indicate that a
direct denial-of-service attack is underway,
and in that case would be treated as a security
event. In other contexts, overflowing logs may
simply be the result of lax archiving policies
or a poor understanding about which system
events are higher value and which are lower.
Formula: Number of instances during
examination period that the central log
management system ran out of memory
Related KRIs/KPIs: Percentage of Systems
With Monitored Event and Activity Logs,
Number of Failures to Properly Send Logs to
Central Log Management System
4. Number of Repeating Security
Incidents
Definition: The number of security incident
that occurred more than once during the
measurement period.
Information Security (Cont.)
Rationale: This metric measures the
effectiveness of an IT system’s response to a
repeated threat. Repeating security incidents
that bear similar root causes or exploit similar
weaknesses in IT infrastructure indicate that
a definite weakness exists in the security
of an IT system, and that this weakness
has not been remedied. A large number of
repeating security incidents occurring during
an examination period would indicate that
a specific set of vulnerabilities should be
addressed immediately.
Formula: The number of similar security
incidents in an examination period
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services
5. Percentage of Database Systems
Storing BOTH Sensitive and Non-
Sensitive Data
Definition: The number of database systems
storing both sensitive and non-sensitive data
as a percentage of total database systems
managed by the company at the same point
in time.
Rationale: This metric measures the quality
of data access authorization procedures as
well as the IS function’s ability to limit or
eliminate the use of potentially vulnerable
systems. Database systems that have
access to both sensitive and non-sensitive
data increases the risk that unauthorized
employees will use, manipulate or leak
important information.
Formula: (Number of Database Systems
Storing Both Sensitive and Non-sensitive data
/ Total Number of Database Systems Used)
* 100
Related KRIs/KPIs: Number of Accounts
Determined to Have Unintended Access to
Sensitive Data Within Last 30 Days, Number
of Systems with Known Vulnerabilities,
Percentage of Systems with Known
Vulnerabilities
6
6. Percentage of Passwords
Currently Not Adhering to
Password Quality Standards
Definition: The total number of monitored
application/system passwords that are not
adhering to password quality standards
(length of password, character diversity used,
etc.) as a percentage of the total number of
passwords monitored at the same point in
time.
Rationale: This metric measures the
vulnerability of a company’s data and the
IS function’s ability to detect and resolve
issues concerning passwords that are not
adhering to password quality standards. Weak
passwords make it all the more easier for
security incidents to occur and sensitive data
to be used, manipulated or leaked.
Formula: (Number of Monitored Passwords
not Adhering to Password Quality Standards /
Total Number of Passwords Being Monitored)
* 100
Related KRIs/KPIs: Number of System/
Application Passwords Audited Within Last
90 Days, Percentage of System/Application
Passwords Audited Within Last 90 Days
7. Percentage of User Accounts
Assigned to a Single Individual
Definition: The number of user accounts
that are assigned to a single individual as
a percentage of the total number of user
accounts managed at the same point in time.
Rationale: This metric measures the risks
related to sharing user accounts amongst
employees. When accounts are shared
(assigned to more than one individual) , there
is a decrease in accountability for the activity
that takes place on the shared account.
For instance, any unauthorized activity or
modifications that take place on the account
cannot be traced back to a single individual.
Formula: (Number of User Accounts
Assigned to a Single Individual / Total Number
of User Accounts) * 100
Information Security (Cont.)
Related KRIs/KPIs: Percentage of User
Accounts with Access to Sensitive Data,
Percentage of Systems/Applications Where
Data Modifications are Traceable to Source,
Number of Instances of Unauthorized Data
Modification
8. Percentage of Systems/
Applications Where Data
Modifications are Traceable to
Source
Definition: The number of systems/
applications in which data modifications are
traceable to a source as a percentage of the
total number of systems/applications in use
within a network at the same point in time.
Rationale: This metric measures an
organization’s ability to hold users
accountable for changes or modifications of
data characteristics based on the system/
application’s capacity to trace those
modifications back to the user. If data
modifications are traceable to a source, it
will reduce the likelihood that an employee
or other threat will attempt to modify data
records in a way that is harmful to the
company.
Formula: (Number of Systems or
Applications Where Data Modifications are
Traceable to a Source / Total Number of
Systems or Applications) * 100
Related KRIs/KPIs: Number of Instances of
Unauthorized Data Modification, Percentage
of User Accounts Assigned to a Single
Individual, Percentage of User Accounts with
Access to Sensitive Data
9. Number of Users with Write
Permissions for Sensitive Data
Definition: The total number of users that
have write permissions for sensitive data at
the time of measurement.
7
Rationale: This metric measures the risk
associated with users that have the ability
to create, change, or modify data that is
sensitive to the company or individuals. The
more users that have write permissions for
sensitive data, the greater chance of that
data being changed or modified in a manner
that could be harmful to the organization
(i.e., changing passwords, altering company
information, etc.).
Formula: Count of Users with Write
Permissions for Sensitive Data
Related KRIs/KPIs: Number of Instances of
Unauthorized Data Modification, Percentage
of Systems/Applications Where Data
Modifications are Traceable to Source,
Percentage of User Accounts with Access to
Sensitive Data
10. Number of Instances of
Unauthorized Data Modification
Definition: The total number of instances
or occurrences in which a user or external
intruder modifies network data without
authorization from the network administrator
during the measurement period.
Rationale: This metric measures the
frequency of occurrences in which there is a
malicious attempt to alter the data records
within the database. A greater number of
instances of unauthorized data modification
will indicate that the organization is at a
greater risk due to identity theft, potential
data breaches, account permission changes,
client information modifications, etc.
Formula: Count of Instances of Unauthorized
Data Modification
Related KRIs/KPIs: Number of Security
Incidents Resulting in Unauthorized
Data Access or Leak (Total), Percentage
of Systems/Applications Where Data
Modifications are Traceable to Source,
Number of Users with Write Permissions for
Sensitive Data
Information Security (Cont.)
Data Privacy Risks
11. Percentage of Devices and
Systems Holding Sensitive Data
that are Not Encrypted
Definition: The number of devices and
systems holding sensitive data (of all
types) that are not currently encrypted as
a percentage of total devices and systems
managed by the organization.
Rationale: This metric should be at or
near 100%. If any device contains sensitive
information, (e.g. IT administrative credentials)
that is not protected by encryption, then an
extremely clear accounting of such devices
must be made, and IT professionals should be
able to make compelling arguments for their
existence. Additional measures such as air-
gap security should be taken. A decreasing
trend in a time-series of this metric will
indicate serious vulnerability of an IT system.
Formula: (Number of devices and systems
that possess sensitive information and
were not protected by encryption during
examination period) / (Number of devices and
systems that possess sensitive information in
the IT system during examination period)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Percentage of System Production
Databases that are Not Encrypted,
Percentage of System Production Applications
that are Not Encrypted
12. Number of Security Incidents
Resulting in Unauthorized Data
Access and Leak (Total)
Definition: The total number of security
incidents (a suspected, attempted,
successful, or imminent threat of
unauthorized access, use, disclosure, breach,
etc. of information) across all applications/
systems in use that result in unauthorized
data access or leak during the measurement
period.
8
Rationale: This metric measures the quality
of data access authorization procedures
and practices and the IS function’s ability to
detect and resolve any issues concerning
unauthorized data access or leaks. The
quicker such issues are detected and
resolved, the less damage will be made to the
company’s sensitive information.
Formula: Number of Security Incidents That
Result in Unauthorized Data Access or Leak
Related KRIs/KPIs: Percentage of Security
Incidents Resulting in Unauthorized Data
Access or Leak of Investor Information,
Percentage of Security Incidents Resulting
in Unauthorized Data Access or Leak of
Financial Information
External Threats
13. Time Between Security
Incidents (All Incident Types)
Definition: The amount of time (measured
in days) elapsed between system security
incidents, measured from the moment
the security incident is detected, until the
time that the following security incident is
detected. (includes the time required to run
any security patches and system updates
after the first incident).
Rationale: This metric measures the change
in system security following a security patch
or other update. For instance, a shorter Time
Between Security Incidents might indicate
that a previous security patch was either
ineffective, or opened the system up to new
security risks.
Formula: Sum of time between failures for
system(s) being examined
Related KRIs/KPIs: All Systems, System
Availability - All Systems, Mean Time Between
Security Incidents (All Incident Types), Mean
Time Between Security Incidents That Affect
Critical Operations & Services
Information Security (Cont.)
14. Number of Expired Certificates
Within the Network
Definition: The total number of certificates
in the organization’s network that have
passed their expiration date at the point of
measurement.
Rationale: This metric measures the
number of out-of-date security certificates
on a computer system. If the network holds
expired certificates, then the trust of a
secure communication on the network is
undermined. In the worst-case scenario,
an expired certificate will use an obsolete
hashing algorithm that can be broken by
brute-force attack and make the channel
vulnerable. More generally, users will
encounter security warnings on their browsers
when they visit your network.
Formula: Number of expired security
certificates found during examination period
Related KRIs/KPIs: Percentage of Systems
With Monitored Event and Activity Logs,
Number of Failures to Properly Send Logs to
Central Log Management System, Number of
Instances Where Central Log Management
System Exceeded Storage Availability
Requirements
15. Number of Security Incidents
(All Incident Types)
Definition: The number of security incidents
(for all attack vectors) detected within a
measurement period.
Rationale: This metric counts the number
of security incidents in a given measurement
period. This information can be analyzed
in a time series to reveal trends of threats.
Spikes of security events occurring after
major system updates might indicate that
new releases are consistently displaying
vulnerabilities, and that changes should be
made to the development cycle. Regularly
occurring cycles of security incidents can
be studied so to harden the network against
repeating threats.
9
Formula: Number of security incidents during
examination period
Related KRIs/KPIs: All Systems, System
Availability - All Systems, Mean Time Between
Security Incidents (All Incident Types), Mean
Time Between Security Incidents That Affect
Critical Operations & Services
16. Percentage of Security
Incidents Affecting System
Availability - All Systems
Definition: The percentage of security
incidents in which any subsystem of an IT
system became unavailable for legitimate
users.
Rationale: This metric measures the relative
weight of security incidents in which service
was interrupted for legitimate users. A large
number for this metric would indicate that
an IT system is highly vulnerable to attacks
and that best practices for all security
incidents should be reviewed. Additionally, IT
professionals should adjust the development
cycle to include safeguards and redundancies
so that service can continue for legitimate
users during future security incidents.
Formula: (Number of service interruption
security incidents during examination period)
/ (Total number of security incidents during
examination period)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Time Between Security Incidents
(All Incident Types)
17. Percentage of Security
Incidents Not Detected by
Monitoring Solutions
Definition: The number of security incidents
that were not detected by installed security
monitoring software as a percentage of total
incidents detected over the same period of
time.
Information Security (Cont.)
Rationale: This metric measures the
effectiveness of the installed security
monitoring solutions designed to automatically
detect, alert users to the presence of, and
terminate certain security threats. A high
value for this metric may indicate that security
monitoring software is not configured to
properly detect threats, which can obviously
expose the organization to risk on all fronts as
it relates to service interruptions, data leaks,
etc.
Formula: (Number of Incidents Not Detected
by Monitoring Solutions / Total Number of
Incidents Detected) * 100
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Time Between Security Incidents
(All Incident Types)
18. Percentage of Devices Not
Covered by Monitoring Solutions
Definition: The number of devices not
currently covered by the company’s
installed IT security monitoring solution as a
percentage of total devices managed at the
same point in time.
Rationale: This metric measures the current
coverage of managed devices in regards to
the monitoring of security threats. A large
value for this metric leaves the organization
to attacks from all vectors for any device
that is not currently covered, which obviously
exposes the company to frisk on all fronts due
to possible service interruptions, data leaks,
etc.
Formula: (Number of Devices Not Covered by
Monitoring Solution / Total Number of Devices
Managed) * 100
Related KRIs/KPIs: None
10
19. Percentage of Devices Not
Covered by Monitoring Solutions
(by Support/Maintenance
Contract)
Definition: The number of devices not
currently covered by the company’s
installed IT security monitoring solution as a
percentage of total devices managed at the
same point in time.
Rationale: This metric measures the current
coverage of managed devices in regards to
the monitoring of security threats. A large
value for this metric leaves the organization
to attacks from all vectors for any device
that is not currently covered, which obviously
exposes the company to frisk on all fronts due
to possible service interruptions, data leaks,
etc.
Formula: (Number of Devices Not Covered by
Monitoring Solution / Total Number of Devices
Managed) * 100
Related KRIs/KPIs: None
20. Percentage of Employees
Receiving Core Information
Security Training Within the Last
Year
Definition: The number of employees
receiving core information security training
within the past year as a percentage of total
employees who received core information
security training.
Rationale: This metric measures
knowledgebase of employees concerning
information security as well as which
employees are in need of further training.
By enforcing periodic training sessions, the
IS function is able to ensure employees are
aware of current policies and procedures to
follow.
Formula: Number of Employees Receiving
Core Information Security Training Within
the Last Year / Total Number of Employees
Working for the Company who Previously
Received Core Information Security Training)
* 100
Information Security (Cont.)
Related KRIs/KPIs: Number of ALL
Employees Whose Access Rights Have
Been Reviewed Within the Last 90 Days,
Percentage of ALL Employees Whose Access
Rights Have Been Reviewed Within the Last
90 Days
21. Percentage of Employees
Passing Internal Email Phishing
Test
Definition: The number of employees who
pass the internal email phishing test as a
percentage of the total number of employees
who participate in the internal email phishing
test during the measurement period.
Rationale: This metric measures the
employees’ vulnerability of being defrauded
by email phishing scams into releasing private
information such as usernames, passwords,
or credit card information, which could
potentially be harmful to the individual or the
organization. Employees who fail this test
should be subject to additional training related
to identifying email phishing attempts.
Formula: (Number of Employees who Pass
Internal Email Phishing Test / Total Number of
Employees who Participate in Test) * 100
Related KRIs/KPIs: Percentage of
Employees Receiving Core Information
Security Training Within the Last Year,
Percentage of Security Incidents Related
to Social Engineering, Mean Time Between
Security Incidents Related to Social
Engineering
22. Percentage of Employees that
Have Accepted & Signed Social
Media Policy
Definition: The number of employees
working for the company that have signed
and accepted the most recent version of
the company’s social media policy, as a
percentage of total employees.
11
Rationale: This metric measures the
company’s coverage in regards to social
media policies and related controls put
in place to protect the organization from
reputational harm, or potential social
engineering attacks through social media
channels. Lack of adherence to social
media policies can lead to risk related to
misrepresentation of the company, misuse of
proprietary information, malware infections
and privacy violations. This value should be
100%.
Formula: (Number of Employees That Have
Signed Latest Social Media Policy / Total
Number of Employees) * 100
Related KRIs/KPIs: Mean Time Between
Security Incidents Related to Social
Engineering
Internal Threats
23. Percentage of Security
Incidents Involving Endpoint
Devices
Definition: The percentage of security
incidents in which an endpoint device (PCs,
mobile phones, tablets, laptops, etc.) was
involved.
Rationale: This metric measures the
relative weight of endpoint-related security
incidents. A larger Percentage of Security
Incidents Involving Endpoint Devices would
indicate that an IT system’s client-facing
or public-facing applications for personal
computers, smartphones or tablets are being
used maliciously. IT staff should enforce
screening and sanitization of any in-bound
data and requests from an endpoint device. A
Time-series may demonstrate the efficacy of
deployed countermeasures.
Formula: (Number of endpoint-related
security incidents during examination period)
/ (Total number of security incidents during
examination period)
Information Security (Cont.)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services
24. Percentage of Security Incident
False Positives
Definition: The percentage of incidents in
which security systems and protocols raised
a false alarm of an attack when later analysis
determined that none had occurred.
Rationale: This metric measures the
accuracy of security systems and protocols
in analyzing system events and making
determinations of whether or not illegal
activity is occurring on a network. Ideally,
this number should be as low as possible. A
larger value of this metric will indicate that
IT professionals are not able to effectively
recognize signs of a genuine attack. This
could result in an attack raising no alarms at
all, as well as generate complacency about
warning signs raised by an IT system.
Formula: (Number of false positive security
incidents during examination period) /
(Total number of security incidents during
examination period)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Time Between Security Incidents
(All Incident Types)
25. Percentage of Security
Incidents Detected by Perimeter
Security Measures
Definition: The percentage of security
incidents that were detected by perimeter
(first line of defense) security measures.
12
Rationale: This metric measures the
effectiveness of the outer-most defensive
layer of an IT system. The majority of attacks
should be caught at the perimeter. Most
basic attacks involve sending engineered
requests from client endpoints to the server.
Most of these attacks can be prevented
through request sanitization, white-lists and
parameterized SQL queries. A large value may
indicate that safeguards are not in place, or
that an IT system suffers from an unusually
large volume of sophisticated attacks.
Formula: (Number of perimeter security
incidents during examination period) /
(Total number of security incidents during
examination period)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Time Between Security Incidents
(All Incident Types)
26. Number of Security Incident
Detection Mechanism Failures
Definition: The percentage of security
incidents in which deployed safe-guards failed
to prevent the execution of an attack.
Rationale: This metric measures the
effectiveness of security systems and
protocols against known and predictable
security threats. While zero-day vulnerabilities
open a system to unforeseen attacks, most
attacks proceed along well-understood
lines. This metric should ideally be as low
as possible. A higher value of this metric
indicates that security systems are simply
ineffective and need to be audited or
redesigned.
Formula: (Number of security mechanism
failure incidents during examination period)
/ (Total number of security incidents during
examination period)
Related KRIs/KPIs: Percentage of Security
Incidents Affecting Critical Operations &
Services, Time Between Security Incidents
(All Incident Types)
Information Security (Cont.)
27. Mean Time to Remove
Unauthorized Application from
System
Definition: The average amount of time
(measured in minutes) required to remove
unauthorized applications (removable media,
files with extensions of known executables
- .exc, .msi, .bin -, etc.) from a company
system, measured from the time unauthorized
applications are identified (usually through
system testing and monitoring) until when
they are removed from the system (performed
through application control software such
as the Continuous diagnostic and Mitigation
Software Asset Management program).
Rationale: This metric measures the IS
function’s ability to remove and prevent
unauthorized applications from accessing
internal systems, and ensure that all identified
unauthorized applications are removed from
all workstations, devices, servers, etc.
Formula: (Sum of Minutes Required to
Remove Unauthorized Applications from
all Systems) / (Number of Unauthorized
Applications Removed During the Same
Period of Time Across all Systems)
Related KRIs/KPIs: Percentage of Endpoints
Using Whitelisting to Block Unauthorized
Application Use, Percentage of Endpoints
in Compliance With Authorized Application
Whitelist
28. Number of Accounts
Determined to Have Unintended
Access to Sensitive Data Within
Last 30 Days
Definition: The total number of employee
accounts determined to have unintended
access to sensitive data (across all
applications/systems in use) within the last 30
calendar days.
Rationale: This metric measures the quality
of data access authorization procedures as
well as the IS function’s ability to identify and
resolve issues involving unintended access
to sensitive data. Unintended access to
sensitive data increases the chance of use,
manipulation or leakage of important data.
13
Formula: Number of Employee Accounts
Determined to have Unintended Access to
Sensitive Data
Related KRIs/KPIs: Number of Security
Incidents Resulting in Unauthorized Data
Access or Leak (Total), Percentage of Security
Incidents Resulting in Unauthorized Data
Access or Leak of Investor Information,
29. Number of Administrator
Logins Detected Outside of Typical
Business Hours
Definition: The total number of administrator
logins detected (across all applications/
systems in use) outside of typical business
hours (10am-3pm, Sunday - Thursday) during
the measurement period.
Rationale: This metric measures the quality
and compliance of data access authorization
procedures as well as the IS function’s
ability to identify and resolve issues involving
administrator logins outside of typical
business hours. Administrator logins outside
of typical business hours may indicate stolen
or leaked credentials or even attempted
logins by employees no longer working for the
company.
Formula: Number of Administrator Logins
Detected Outside of Typical Business Hours
Related KRIs/KPIs: Number of Security
Incidents Resulting in Unauthorized Data
Access or Leak (Total), Number of Failed
Attempts to Access User Accounts with
Access to Sensitive Data
30. Number of Security Incidents
Related to Recent Changes
Definition: The total number of security
incidents (a suspected, attempted,
successful, or imminent threat of
unauthorized access, use, disclosure, breach,
etc. of information) across all applications/
systems in use that are related to recent
application or system changes (successful or
failed) during the measurement period.
Information Security (Cont.)
Rationale: This metric measures the quality
of one-off patches or minimal upgrades
recently put in place as well as the IS
function’s ability to detect and resolve any
resulting security incidents. The quicker
security incidents are detected, the quicker
patches and upgrades can be created to
resolve current incidents and prevent any
future incidents from occurring.
Formula: Number of Security Incidents that
are Related to Recent System Changes
Related KRIs/KPIs: Percentage of Security
Incidents Related to Recent Changes, Number
of Security Incidents Related to Recent
Releases, Percentage of Security Incidents
Related to Recent Releases
31. Number of Security Incidents
Related to Recent Releases
Definition: The total number of security
incidents (a suspected, attempted,
successful, or imminent threat of
unauthorized access, use, disclosure, breach,
etc. of information) across all applications/
systems in use that are related to recent
application or system releases (successful or
failed) during the measurement period.
Rationale: This metric measures the quality
of significant IS upgrades or application
launches recently put in place as well
as the IS function’s ability to detect and
resolve any resulting security incidents. The
quicker security incidents are detected,
the quicker they can be resolved, with any
resolutions reflected in future upgrades and/
or application launches.
Formula: Number of Security Incidents that
are Related to Recent Releases
Related KRIs/KPIs: Percentage of Security
Incidents Related to Recent Releases,
Percentage of Security Incidents Related
to Recent Changes, Number of Security
Incidents Related to Recent Changes
14
32. Number of System/Application
Passwords Audited Within Last 90
Days
Definition: The total number of system/
application passwords audited (typically
performed by software packages that
measure the strength of passwords) within
the last 90 calendar days.
Rationale: This metric measures the
strength of the passwords used by the
company and the IS function’s ability to
detect potential threats from weak or obsolete
passwords. Weak passwords make it all the
more easier for security incidents to occur
and sensitive data to be used, manipulated
or leaked. The company should establish
and enforce standard password parameters
(length, use of characters, etc.).
Formula: Number of System/Application
Passwords Audited Within the Last 90
Calendar Days
Related KRIs/KPIs: Percentage of System/
Application Passwords Audited Within Last 90
Days, Percentage of Passwords Currently Not
Adhering to Password Quality Standards
33. Number of Systems with
Known Vulnerabilities
Definition: The total number of systems or
applications that have known vulnerabilities
(i.e., a weakness in automated systems
security procedures, administrative controls,
Internet controls, etc. that could be exploited
by a threat to gain unauthorized access to
information) at the time of the measurement.
Rationale: This metric measures the
vulnerability of a company’s systems and/or
applications in a given measurement period.
This information can be analyzed to reveal
potential issues that need to be resolved. For
instance, systems or applications with weak
Internet controls are susceptible to more
attacks by malware, hacking, etc. Known
vulnerabilities should be prioritized based on
severity and addressed ASAP by IT staff.
Formula: Number of Systems or Applications
that Have Known Vulnerabilities
Information Security (Cont.)
Related KRIs/KPIs: Percentage of Systems
with Known Vulnerabilities, Number of Known
Vulnerabilities Outstanding for More Than 90
Days, Percentage of Known Vulnerabilities
Outstanding for More Than 90 Days
34. Number of Known
Vulnerabilities Outstanding for
More Than 90 Days
Definition: The total number of known
system or application vulnerabilities (i.e., a
weakness in automated systems security
procedures, administrative controls, Internet
controls, etc. that could be exploited by
a threat to gain unauthorized access to
information) that have yet to be resolved after
90 calendar days.
Rationale: This metric measures the
vulnerability of a company’s systems and/
or applications in a given measurement
period as well as the IS function’s ability to
detect and resolve known vulnerabilities in
a timely fashion. The quicker vulnerabilities
are detected and dealt with, the smaller the
window will be for hackers and malware to
do damage or access data (sensitive or non-
sensitive).
Formula: Number of Known System or
Application Vulnerabilities that Have Yet to be
Resolved After 90 Calendar Days
Related KRIs/KPIs: Percentage of Known
Vulnerabilities Outstanding for More Than
90 Days, Number of Systems with Known
Vulnerabilities, Percentage of Systems with
Known Vulnerabilities
35. Percentage of Endpoints Using
Whitelisting to Block Unauthorized
Application Use
Definition: The total number of endpoints
that use application whitelisting to block
unauthorized application use as a percentage
of the total number of active endpoints that
are managed by the IS function at the same
point in time.
15
Rationale: This metric measures the IS
function’s ability to prevent unauthorized or
potentially harmful programs or applications
from running on a company system through
the use of whitelisting. Whitelists must
be maintained, updated and continually
enforced in order to prevent applications with
known vulnerabilities or risks from running
on the company’s network. Failure to do so
increases the likelihood of data leaks and
related reputational harm. This number should
at or close to 100%
Formula: (Number of Endpoints Using
Whitelisting / Total Number of Endpoints) *
100
Related KRIs/KPIs: Percentage of Endpoints
in Compliance With Authorized Application
Whitelist, Number of Systems with Known
Vulnerabilities, Percentage of Systems with
Known Vulnerabilities
36. Number of Instances of
Unusual Outbound Network Traffic
in Last 7 Days
Definition: The total number of instances
or occurrences of unusual outbound network
traffic that has occurred within the last 7 days
of the measurement date.
Rationale: This metric measures the
frequency of outbound traffic activity that can
be harmful to the organization such as visiting
malicious websites, access to externally
compromised unofficial network resources
(DNS, NTP, etc.), using third party data
sharing applications (Dropbox, etc.) or using
other covert channels to transmit information
outside of the network. Outbound connection
controls or firewalls can mitigate these
outbound risks.
Formula: Count of Instances of Unusual
Outbound Network Traffic in Last 7 Days
Related KRIs/KPIs: Number of Failed
Attempts to Access User Accounts with
Access to Sensitive Data, Number of ALL
Employees Whose Access Rights Have Been
Reviewed Within the Last 90 Days
Information Security (Cont.)
37. Number of Detected Attempts
to Elevate Account Permissions
Without Authorization
Definition: The total number of instances in
which the network administrator detects an
attempt by an account user to elevate their
account permissions without the authorization
of the network administrator during the
measurement period.
Rationale: This metric measures risk
related to the unauthorized attempt of
account users to enhance or elevate their
account permissions or privileges without the
authorization of the account administrator. An
attempt to enhance user account permissions
can indicate not only who may be a potential
threat to the organization but also what type
of action the potential threat might pose to the
organization.
Formula: Count of Detected Attempts
to Elevate Account Permissions Without
Authorization
Related KRIs/KPIs: Mean Time to
Deactivate Departing Employee Account,
Number of Accounts Determined to Have
Unintended Access to Sensitive Data Within
Last 30 Days, Number of Failed Attempts
to Access User Accounts with Access to
Sensitive Data
38. Number of Dormant Employee
Accounts
Definition: The total number of employee
accounts in a company information system
that are dormant (i.e., account has not had
any login activity in 90 or more calendar days)
at the time of the measurement.
Rationale: This metric measures the number
of dormant accounts that are vulnerable to
intruders that may try to use the dormant
account to seek access to a company
system. Dormant accounts present a risk to
information systems because the account’s
(inactive) user will not detect the unusual or
unauthorized use of that account.
16
Formula: Count of Dormant Employee
Accounts
Related KRIs/KPIs: Mean Time to
Deactivate Departing Employee Account,
Number of ALL Employees Whose Access
Rights Have Been Reviewed Within the
Last 90 Days, Number of Failed Attempts
to Access User Accounts with Access to
Sensitive Data
39. Number of Orphaned Employee
Accounts
Definition: The total number of active
accounts that are orphaned (i.e., employee/
user is no longer with the organization) at the
time of measurement.
Rationale: This metric measures the number
of orphaned accounts that are vulnerable
to intruders (i.e., any user, past or present,
who does not have permission to use the
account) that may try to use the orphaned
account to seek access to a company system.
Orphan accounts present a risk to information
systems because the account’s (absent) user
will not detect the unusual or unauthorized
use of that account. Network administrators,
may not realize that the orphaned account
should not be in use.
Formula: Count of Orphaned Employee
Accounts
Related KRIs/KPIs: Mean Time to
Deactivate Departing Employee Account,
Number of ALL Employees Whose Access
Rights Have Been Reviewed Within the
Last 90 Days, Number of Failed Attempts
to Access User Accounts with Access to
Sensitive Data
40. Number of Failed Attempts to
Access User Accounts with Access
to Sensitive Data
Definition: The total number of instances in
which an account user attempts to access
user accounts that have access to sensitive
data, but does not succeed in accessing that
account.
Information Security (Cont.)
Rationale: This metric measures the
frequency of internal threats attempting to
gain access to sensitive data that could be
used against the organization if that data gets
into the wrong hands. An excessive number of
failed attempts should raise a red flag - if the
source of the attempts can be traced back to
an individual, that person should be subject to
questioning to determine their motives.
Formula: Count of Failed Attempts to Access
User Accounts with Access to Sensitive Data
Related KRIs/KPIs: Number of Failed
Attempts to Access User Accounts with
Access to Sensitive Data, Number of ALL
Employees Whose Access Rights Have Been
Reviewed Within the Last 90 Days
41. Mean Time to Deactivate
Departing Employee Account
Definition: The average amount of time
(measured in days) required to deactivate a
departing employee’s account, measured
from the day the departing employee
has worked his or her final day with the
organization until the day that the network
administrator deactivates the departing
employee’s account.
Rationale: This metric measures the
average length of time (measured in days)
that departing employees’ accounts remain
active after their departure from the company,
which leaves the company systems more
vulnerable to potential attackers. Current
or former employees may target departed
employee accounts that are not deactivated
(i.e., orphaned accounts) to enact some form
of retribution or simply because the (absent)
account owner is not able to detect any
unusual activity.
Formula: (Sum of Time to Deactivate
Departing Employee Accounts / Number of
Departing Employee Accounts Deactivated)
Related KRIs/KPIs: Number of Dormant
Employee Accounts, Number of Failed
Attempts to Access User Accounts with
Access to Sensitive Data, Number of ALL
Employees Whose Access Rights Have Been
Reviewed Within the Last 90 Days
17
42. Number of ALL Employees
Whose Access Rights Have Been
Reviewed Within the Last 90 Days
Definition: The number of company-wide
employees whose account access rights or
privileges have been reviewed within the last
90 calendar days.
Rationale: This metric measures the risk
associated with certain employees potentially
having network access rights that they should
not be granted. If an employee has access
to files or network rights that they should
not be granted, there is a greater risk to
the company of information leaks, or other
potential data breaches, whether intentional
or unintentional.
Formula: Count of All Employees Whose
Access Rights Have Been Reviewed within the
Last 90 Days
Related KRIs/KPIs: Percentage of ALL
Employees Whose Access Rights Have Been
Reviewed Within the Last 90 Days, Number
of Employees With Access to Sensitive Data
Whose Access Rights Have Been Reviewed
Within the Last 90 Days
43. Number of Employees With
Access to Sensitive Data Whose
Access Rights Have Been Reviewed
Within the Last 90 Days
Definition: The total number of employees
who have access to sensitive data whose
access rights have gone under a formal
review by the network administrator within the
last 90 calendar days.
Rationale: This metric measures the
organization’s practice of routinely reviewing
the sensitive data access rights of employees.
When employees get promoted or move
within departments of an organization, their
need to access sensitive data may change. A
routine review or audit of employees’ sensitive
data access rights will help ensure that
only the employees who need to access the
sensitive data will have access to it.
Information Security (Cont.)
Formula: Count of Employees with Access
to Critical Data/Information Whose Access
Rights Have Been Reviewed Within the Last
90 Days
Related KRIs/KPIs: Percentage of
Employees With Access to Sensitive Data
Whose Access Rights Have Been Reviewed
Within the Last 90 Days, Percentage of User
Accounts with Access to Sensitive Data,
Number of Users with Write Permissions for
Sensitive Data
44. Percentage of User Accounts
with Access to Sensitive Data
Definition: The number of user accounts that
have access to sensitive data as a percentage
of the total number of user accounts managed
at the same point in time.
Rationale: This metric measures the degree
of risk that an organization is exposed to that
stems from how many users are prohibited
from accessing sensitive data vs. how many
users are granted authorized access to the
sensitive data. If any sensitive data is leaked
or breached, it will likely be harmful to the
organization.
Formula: (Number of User Accounts with
Access to Sensitive Data / Total Number of
User Accounts) * 100
Related KRIs/KPIs: Number of Employees
With Access to Sensitive Data Whose Access
Rights Have Been Reviewed Within the Last
90 Days, Percentage of User Accounts with
Access to Sensitive Data, Number of Users
with Write Permissions for Sensitive Data
45. Mean Time to First Exploit
Definition: The average amount of time
(measured in days) required for the first
exploit to take place from the day a computer
application or system is launched until the day
that the first exploit occurs.
18
Rationale: This metric measures the quality
of security that a system or application was
set up with. With a low mean time to first
exploit, network administrators may need to
decide that they need to spend more time
on security before launching a system or
application.
Formula: (Sum of Times to First Exploit /
Total Number of First Exploits)
Related KRIs/KPIs: Number of Security
Incidents Related to Recent Releases, Number
of Systems with Known Vulnerabilities,
Number of Known Vulnerabilities Outstanding
for More Than 90 Days
46. Mean Time to Incident
Detection
Definition: The average amount of time
(measured in minutes) required for the
network administrator to detect a security
incident from the time that the incident occurs
until the time that the security incident is
detected by the network administrator.
Rationale: This metric measures the risks
associated with undetected security incidents
by an organization’s network administrator.
When a security incident is undetected,
the network administrator cannot take any
action to block the threat or mitigate any
damage that the security incident has already
incurred.
Formula: (Sum of Time to Detect a Security
Incident / Total Number of Security Incidents
Detected)
Related KRIs/KPIs: Percentage of Security
Incidents Detected by Perimeter Security
Measures, Security Incident False Positive
Rate, Number of Security Incidents Related to
Recent Releases
Information Security (Cont.)
47. Number of Rogue Access Points
Identified
Definition: The number of unauthorized
access points identified within the network
through network scanning activities
conducted during the measurement period.
Unauthorized, or “rogue,” devices pose a
serious security threat to the organization.
These devices can be used by external and/
or internal attackers to transmit sensitive
information outside the network, list employee
credentials and/or install malicious files on
the company’s network. Ideally, this value
would be 0.
Rationale: This metric measures risk related
to the connection of a wireless access point
that is not controlled by the company’s
security protocols to the company’s network.
Formula: Count of Rogue Devices Detected
on Company’s Network During Measurement
Period
Related KRIs/KPIs: Count of Rogue Devices
Detected on Company’s Network During
Measurement Period

19
Information
Technology
• IT Development Risks
• IT Planning & Performance
Management Risks
• Technology Infrastructure Risks

21
Information Technology
IT Development Risks
1. Percentage of Scheduled
Maintenance Activities Missed
Definition: The number of scheduled
maintenance activities related to company
devices (workstations, network equipment,
servers) that did not take place on or before
their scheduled date as a percentage of all
maintenance activities scheduled to occur over
the same period of time.
Rationale: This metric measures the IT
function’s adherence to preventative and
scheduled maintenance plans. Missed
scheduled maintenance activities increase the
likelihood of service interruptions, productivity
losses and security incidents. Instances of
missed schedule maintenance activities should
be traced back to the responsible party to
identify and correct the root cause.
Formula: (Number of Scheduled Maintenance
Activities Carried Out On-Time / Total Number
of Scheduled Maintenance Activities to be
Carried Out) * 100
Related KRIs/KPIs: Total Scheduled
Downtime - All Systems
2. Percentage of Systems
Undergoing New Releases - All
Systems
Definition: The total number of application or
systems where a new release was completed
or attempted by the IT function during the
measurement period as a percentage of total
systems managed.
Rationale: This metric measures the total
amount of activity in regards to new releases
performed by the IT team. A high number
of releases can be indicative of risk arising
from environment uncertainty (internal and
customer-facing), downtime (planned and
unplanned), performance issues and employee
productivity.
Formula: (Number of Systems Where Release
was Completed or Attempted / Total Number
of Systems Managed) * 100
23
Related KRIs/KPIs: Percentage of
Unsuccessful Releases
3. Percentage of Unsuccessful
Releases
Definition: The number of releases rolled
out by the IT function to company devices or
workstations that must be rolled back (i.e.,
affected systems are restored to pre-release
state through version control, or similar) due to
issues that occurred following the release as
a percentage of total releases attempted (i.e.,
successful and failed) over the same period
of time.
Rationale: This metric measures the
IT function’s diligence in testing and
implementing releases successfully. Failed
releases may cause downtime for employees
and customers leading to lost revenue and
poor customer experience. Furthermore,
repeated release failures divert IT staff’s
attention from other potentially more important
tasks that can lead to risk regarding missed
deadlines, un-patched vulnerabilities, etc.
Formula: (Number of Failed Releases / Total
Number of Attempted Releases) * 100
Related KRIs/KPIs: Percentage of System
Releases Mirrored on Backup Systems Within
24 Hours Following Launch
4. Percentage of Systems
Undergoing Changes - All Systems
Definition: The total number of application or
systems where a new change was completed
or attempted by the IT function during the
measurement period as a percentage of total
systems managed.
Rationale: This metric measures risk related
to system stability and user experience, as
well as the IT functions ability to maintain and
release stable services. While a solid change
management foundation is vital, too many
changes can be indicative of an underlying
issue related to release management and
application development capabilities.
Information Technology (Cont.)
Formula: (Number of Systems Where
Change was Completed or Attempted / Total
Number of Systems Managed) * 100
Related KRIs/KPIs: Percentage of
Unsuccessful Changes - All Levels of Impact
5. Percentage of Unsuccessful
Changes - All Levels of Impact
Definition: The number of changes rolled
out by the IT function to company devices
or workstations that must be rolled back
(i.e., affected systems are restored to pre-
change state through version control, or
similar) due to issues that occurred following
the implementation of the change, as a
percentage of total changes attempted over
the same period of time.
Rationale: This metric measures
the quality of IT change management
practices and related risk stemming from
excessive changes, poor application/
system management and rework. Change
Management protocols must be put in place
to minimize downtime, monitor change
coverage (i.e., control which endpoints or
devices are changed and when) and ensure
that implemented changes are thoroughly
tested prior to live environment roll out.
Formula: (Number of Failed Changes / Total
Number of Attempted Changes) * 100
Related KRIs/KPIs: Percentage of Systems
Undergoing Changes - All Systems
6. Percentage of Changes
Considered Emergency Changes
Definition: The number of changes, or
patches, to systems, devices and applications
that are considered to be an emergency as a
percentage of changes made over the same
period of time. An emergency change is a
previously unplanned change to systems
or applications that must be implemented
immediately, or as soon as possible, to avoid
a serious security risk, productivity loss, and/
or service interruption.
24
Rationale: This metric measures the
diligence of IT change and release
management practices, with a specific focus
on controls built in to proactively identify and
address issues that may arise in the future.
Emergency changes may not be entirely
avoidable, however proactive patching,
performance monitoring and vulnerability
management may reduce instances of such
changes.
Formula: (Number of Emergency Changes /
Total Number of Attempted Changes) * 100
Related KRIs/KPIs: Percentage of System
Changes Mirrored on Backup Systems Within
24 Hours Following Launch
7. Percentage of Applications
Requiring Functionality Upgrade
Within the Last 90 Days
Definition: The total number of applications
used by the company that required an
upgrade related to user experience/usability
within the last 90 calendar days.
Rationale: This metric measures the IT
function’s ability to develop and deliver
applications that meet user expectations and
require minimal rework related to usability
and user experience. While applications will
likely require upgrades at some point during
their lifecycle, excessive upgrades may
be indicative of poor front-end planning in
regards to operating environment, end user
needs and related business requirements.
Formula: (Number of Applications Requiring
Post-Launch Upgrade / Total Number of
Proprietary Applications In Use) * 100
Related KRIs/KPIs: Number of IT Projects
that Required Rework Due to Misaligned
Requirements Within the Last 90 Days
Information Technology (Cont.)
8. Percentage of IT Projects
Reworked Due to Misaligned
Requirements Within the Last 90
Days
Definition: The number of IT projects that,
within the last 90 days, required re-scoping or
re-prioritization due to business requirements
that were not clearly defined, or were not
sufficiently reviewed by key stakeholders prior
to project launch as a percentage of total IT
projects running.
Rationale: This metric measures the IT
function’s ability to accurately and exhaustively
capture business requirements that align
with overall company strategy and end
user goals prior to the start of the project.
Poor performance in business requirement
gathering leads to project rework, cancellation
and related opportunity cost.
Formula: (Number of IT Projects Requiring
Re-Scoping / Total Number of IT Projects
Running) * 100
Related KRIs/KPIs: Percentage of IT Projects
Delayed, Percentage of IT Projects That
Exceeded Budget
9. Percent Change in Number of
Website Visits - Month over Month
(MoM)
Definition: The percent difference in the
total number of users that visited the website
through all channels (organic search, paid
search, direct, referral, etc.) from month-to-
month.
Rationale: This metric measures overall
traffic to the company’s website, which
can be reflective of the company’s web
presence, SEO practices and the quality of
digital marketing practices. A time-series of
this metric can be analyzed to detect large
increases/decreases in traffic, which may
be indicative of changes to search engine
algorithms, mis-configured traffic tracking
code, digital marketing practices or the need
for changes to the company’s web server
capacity.
25
Formula: ((Current Month Total Website
Visits - Previous Month Total Website Visits) /
Previous Month Total Website Visits) * 100
Related KRIs/KPIs: Average Page Load
Time, Average Time on Site, Average Page
Views per Visit, Bounce Rate
10. Bounce Rate
Definition: The number of users that view
only one web page when visiting the site
before exiting (i.e., bouncing) as a percentage
of total website visits over the same period
of time. A high Bounce Rate can indicate that
the website is not sufficiently designed to lead
users to other locations around the website.
Rationale: This metric measures the quality
of the website’s design and user experience.
Poor design and website architecture can lead
to high bounce rates, which in turn can mean
that users are not finding the appropriate
information on the company’s website.
Formula: (Number of Website Visitors that
View Only a Single Web Page / Total Number
of Website Visits) * 100
Related KRIs/KPIs: Average Page Load
Time, Average Time on Site, Average Page
Views per Visit
11. Average Page Load Time
Definition: The average amount of time (in
seconds) required for the user’s browser to
full load a web page within the company’s
website, from the time the click occurs until
the web browser has loaded the page in full.
Rationale: This metric measures the
quality of the website’s architecture and
corresponding methods taken to reduce load
times which can lead to improved search
engine rankings and user experience. High
load pages times are proven to diminish user
experience, particularly for web applications
and interactive websites.
Formula: (Sum of page load time across 30
most-viewed web pages) / 30
Related KRIs/KPIs: Bounce Rate
Information Technology (Cont.)
12. Average Page Views per Visit
Definition: The average number of individual
web pages viewed by a website visitor during
the course of a single visit, or session, during
the measurement period.
Rationale: This metric measures the quality
of user engagement, which speaks to the
overall design and architecture of the website.
Websites that are not well-designed, or those
that do not provide relevant information to
the user shortly after landing on the site, will
typically exhibit a low value for this metric.
Formula: Sum of Total Website Page views /
Total Number of Website Visits
Related KRIs/KPIs: Bounce Rate, Total
Number of Website Visits, Average Page Load
Time, Average Time on Site, Average Page
Views per Session
13. Average Time on Site
Definition: The average amount of time a
website visitor spends on the website, from
the time that the user lands on a page until
they exit the website, during the course
of a single visit, or session, during the
measurement period.
Rationale: This metric measures the quality
of user engagement, which speaks to the
overall design and architecture of the website.
Websites that are not well-designed, or those
that do not provide relevant information to
the user shortly after landing on the site, will
typically exhibit a low value for this metric.
Formula: Sum of Total Time Spent on
Website / Total Number of Website Visits
Related KRIs/KPIs: Bounce Rate, Total
Number of Website Visits, Average Page
Views per Session
26
14. Percentage of Systems in Use
that are No Longer Supported
Definition: The number of systems currently
in use by the company that are no longer
supported by the original developer as a
percentage of total systems used by the
organization at the same point in time.
These non-supported systems may also be
considered “legacy” systems.
Rationale: This metric measures risk related
to software that is no longer supported by
the original developer, meaning that they no
longer release updates to address security,
usability and/or performance issues, which
leaves the company open to risk in those
areas.
Formula: (Number of Systems in Use That
are No Longer Supported / Total Number of
Systems in Use) * 100
Related KRIs/KPIs: Percentage of Systems
Running without Current Maintenance
Contract - All Systems
IT Planning & Performance
Management Risks
15. Percentage of IT Assets
(Devices) Impacted by End-of-Life
or Support
Definition: The number of devices managed
by the IT Department that are slated to be
impacted by upcoming end-of-life (EoL) or
end-of-support (EoS) dates.
Rationale: This metric measures the
potential impact of upcoming end-of-life (EoL)
or end-of-support (EoS) dates for devices
currently used by the company. A high
percentage of devices with impending EoS or
EoL dates may indicate that the company is
using relatively outdated devices, and/or that
it will be a large undertaking to procure and
implement replacement devices in the near
future.
Information Technology (Cont.)
Formula: (Number of Devices with Upcoming
EoL or EoS Dates / Total Number of Devices
Managed) * 100
Related KRIs/KPIs: Total Value of IT Assets
Currently Not in Use, Percentage of IT Assets
Controlled by Inventory Monitoring
16. Total Number of IT Assets
Current Not in Use
Definition: The total number of IT assets
owned by the organization that are currently
(i.e., at the point of measurement) not used in
any capacity by the organization.
Rationale: This metric measures the IT
function’s diligence in managing IT-related
assets across the organization to ensure that
they are used properly and can be liquidated
when they are no longer able to be used
by the organization. Obsolete or unused IT
assets must also be properly secured to avoid
physical theft, which can then lead to potential
information theft (e.g., data stolen from
unused hard drives or servers).
Formula: Count of Total Unused IT Assets
Related KRIs/KPIs: Total Value of IT Assets
Currently Not in Use, Percentage of IT Assets
Controlled by Inventory Monitoring
17. IT Service Desk - Mean Service
Request Resolution Time (All
Levels)
Definition: The average amount of time
(measured in minutes) required for the IT
support team to resolve, or close, an IT
support request, measured from the time
that the ticket or request is submitted by an
employee until the issue has been resolved
and formally closed.
Rationale: This metric measures the IT
support function’s ability to accept, process
and resolve open issues in a timely fashion.
High resolution times can increase risk
levels related to employee productivity and
service interruptions. It may also be valuable
to segment IT service requests by type and
importance to see if high priority issues are
solved in a more timely fashion than other (as
they should be).
27
Formula: (Sum of Service Request Resolution
Time) / (Count of Requests Successfully
Resolved)
Related KRIs/KPIs: IT Service Desk - Total
Number of Requests Opened (All Levels)
18. IT Service Desk - Total Number
of Requests Opened (All Levels)
Definition: The total number of service
requests, or tickets, received by the IT
service desk team over a certain period of
time. A service request is considered opened
immediately upon reception (regardless of
whether or not the request is acknowledged).
Rationale: This metric measures the total
workload of the IT service desk. Higher than
usual values may result in poor work quality,
or can be indicative of an underlying issue
related to system stability, user-friendliness,
etc. Request volumes should be segmented
by type and prioritized in order to ensure that
critical issues are solved quickly. Viewing this
metric as a time-series may reveal spikes in
request volumes that can be traced to releases
or other incidents causing internal issues.
Formula: Count of Service Requests Opened
Related KRIs/KPIs: IT Service Desk -
Average Number of Requests Opened per
Service Desk Employee, IT Service Desk -
Mean Service Request Resolution Time
19. IT Service Desk - Percentage of
Requests Not Resolved within SLA
(All Levels)
Definition: The number of IT service
requests that are not resolved within the
timeframe defined by the company’s SLA as
a percentage of total issues resolved over the
same period of time.
Information Technology (Cont.)
Rationale: This metric measures the IT
function’s ability to respond, investigate
and resolve requests, or tickets, within the
time frame that the company has defined as
acceptable. A large percentage of issues that
are not resolved within this time frame may
increase the likelihood of productivity/capacity
issues, service interruptions and potential
customer service issues.
Formula: (Number of Requests Resolved
within SLA Time Frame / Total Number of
Requests Resolved) * 100
Related KRIs/KPIs: IT Service Desk - Total
Number of Requests Opened (All Levels)
20. Percentage of Applications
Running without a Current Service
Level Agreement
Definition: The number of applications
currently running on company workstations or
devices that are NOT governed by an explicit,
documented service level agreement (SLA),
which states the parameters and standards
of service to be delivered by the application,
as a percentage of all applications currently
running.
Rationale: This metric measures risk
exposure related to poor performance of
applications used by the company. The lack
of a defined SLA leaves the company without
defined parameters to judge performance
against optimal levels. Poorly performing
applications may open the company to risk
related to poor customer service and lack of
internal productivity.
Formula: (Total Number of Applications
Running without Current SLA / Total Number
of Applications in Use) * 100
Related KRIs/KPIs: None
28
21. IT Service Provider SLA
Adherence
Definition: The number of IT vendor service
level agreements where the vendor has
met or exceeded targets outlined in their
corresponding Service Level Agreement (SLA)
over the last 3 months as a percentage of
total vendor, or service provider, activities and
performance levels are governed by a formal
SLA.
Rationale: This metric measures vendor
management and compliance practices,
and related risk arising from poor vendor
performance and lack of oversight. Vendor
performance should governed through Service
Level Agreements (SLAs) and diligent project
management. Furthermore, SLAs should
define specific metrics and performance
criteria to assess the performance of long-
term vendor relationships.
Formula: (Number of SLA Performance
Metrics Being Met by IT Service Providers /
Total Number of SLA Metrics) * 100
Related KRIs/KPIs: Percentage of Systems
Running without Current Maintenance
Contract - All Systems
22. Internal IT Team SLA
Adherence
Definition: The number of internal service
level agreements where the IT team has
met or exceeded targets outlined in their
corresponding Service Level Agreement (SLA)
over the last 3 months as a percentage of
total IT team activities and performance levels
are governed by a formal SLA.
Rationale: This metric measures IT team
service performance, management and
compliance practices, and related risk
arising from poor performance and/or lack
of oversight. IT service performance should
governed through Service Level Agreements
(SLAs) and diligent project management.
Furthermore, SLAs should define specific
metrics and performance criteria to assess
the performance of the IT group.
Information Technology (Cont.)
Formula: (Number of SLA Performance
Metrics Being Met by IT Team / Total Number
of SLA Metrics) * 100
Related KRIs/KPIs: IT Service Provider SLA
Adherence
23. Percentage of Systems Running
without Current Maintenance
Contract - All Systems
Definition: The number of actively used
systems or applications that do not have a
current maintenance contract in place as
a percentage of total systems/applications
managed at the same point in time.
Rationale: This metric measures the degree
to which systems are covered by maintenance
contracts. A high value for this metric may
indicate that there are several systems without
current maintenance contracts in place, which
can be a leading indicator of potential issues
in the future arising from system malfunctions
or repairs where there is not an external SME
available to provide support in order to correct
the issue within a reasonable timeframe.
Formula: (Number of Systems without
Current Maintenance Contract in Place / Total
Number of Systems Managed) * 100
Related KRIs/KPIs: IT Service Provider SLA
Adherence
24. Number of Disputes with IT
Vendors
Definition: The total number of formal
disputes that took place between the company
and IT-related vendors over the last 3 months.
Vendor disputes may arise due to poor vendor
performance, payment issues and/or project
scope misalignment (i.e., scope “creep”),
among other things.
29
Rationale: This metric measures the IT
function’s ability to procure high quality
IT-related services and ensure that vendor
performance expectations are documented
and managed correctly. Vendor disputes can
open the company to risk related to missed
deadlines, service interruptions and diminished
vendor relationships (forcing the organization
to spend time and money to identify, authorize
and brief a new vendor). This can be
particularly vital when dealing with IT vendors.
Formula: Count of Formal Disputes with IT
Vendors
Related KRIs/KPIs: IT Vendor Service
Level Agreement Adherence, Percentage of
Applications Running With a Current Service
Level Agreement
25. Number of IT Projects Canceled
After Kick-off Within Last 6 Months
Definition: The number of IT projects that
were canceled at some point following the
initial project startup due to lack of alignment
with corporate strategy or planning over the
last 6 months.
Rationale: This metric measures the IT
function’s alignment with corporate strategy,
as well as their ability to deliver projects
based on stakeholder needs and business
requirements. Canceled IT projects reflect
poorly on all involved parties, but particularly
on IT management. Risks related to canceled
IT projects involves opportunity cost (i.e.,
time spent on cancelled project could have
been used elsewhere), missed deadlines and
decreased employee and investor satisfaction.
Formula: Count of IT Projects Formally
Canceled within Last 6 Months
Related KRIs/KPIs: Percentage of IT
Projects Completed On-Schedule, Percentage
of IT Projects Completed On-Budget, Number
of IT Projects that Required Rework Due to
Misaligned Requirements Within the Last 90
Days
Information Technology (Cont.)
26. Percentage of IT Projects
Delayed
Definition: The number of IT projects that
are NOT completed before or on their initial
planned completion (i.e., delayed projects)
date as a percentage of total IT projects
completed over the same period of time.
Rationale: This metric measures the IT
function’s ability to properly document
and plan projects, and adhere to related
requirements. Poor planning, misaligned
resources and/or excessive approval levels or
stage gates may delay IT projects, leading
to risk related to opportunity costs (i.e.,
excess time spent on project could have been
used elsewhere), lost revenue due to missed
deadlines and potential vulnerabilities that
would have been addressed had the project
launched on-time.
Formula: (Number of IT Projects Not
Completed On-Schedule / Total Number of IT
Projects Scheduled for Completion) * 100
Related KRIs/KPIs: Percentage of IT
Projects That Exceeded Budget
27. Percentage of IT Projects That
Exceeded Budget
Definition: The number of IT projects
that exceed the initially developed budget
parameters as a percentage of total IT
projects completed over the same period of
time.
Rationale: This metric measures IT
function’s ability to forecast project costs and
secure the appropriate budgetary approvals,
as well as their ability to deliver the project
using the allocated budget. Over-budget IT
projects carry far more risks than simply
budget overruns - they can be indicative of
poor project scoping, mis-aligned resources
and a lack of diligent requirements gathering.
Formula: (Number of IT Projects Completed
Over Budget / Total Number of IT Projects
Completed) * 100
30
Related KRIs/KPIs: Percentage of IT
Projects Delayed
28. IT Budget Variance (Actual vs.
Budgeted)
Definition: The difference in planned (i.e.,
budgeted) versus actual IT expense for the
entire IT department, or function, during
the measurement period, measured as a
percentage.
Rationale: This metric measures variance
from planned IT department budget, whether
actual expenditures are below or above
the budgeted amount, can be indicative
of poor planning and/or lack of alignment
with corporate strategy within day-to-day IT
operations.
Formula: ((Actual IT Expense - Budgeted IT
Expense) / Budgeted IT Expense) * 100
Related KRIs/KPIs: Percentage of IT
Projects Delayed, Percentage of IT Projects
That Exceeded Budget
Technology Infrastructure
Risks
29. Mean Time Between Failure
(MTBF) - All Systems
Definition: The average amount of time
(measured in days) elapsed between system
failures, measured from the moment the
system initially fails, until the time that
the next failure occurs (including the time
required to perform any repairs after the initial
failure).
Rationale: This metric measures the stability
of systems following a resumption of service
(i.e., a repair following a failure), as well as
the IT function’s ability to regularly develop
and release stable services (initial releases
and changes). A large value for this metric
may indicate that systems are unstable and
underlying architecture must be further
examined. This is particularly vital for critical
customer-facing systems.
Information Technology (Cont.)
Formula: (Sum of time between failures for all
systems) / (Number of failures that occurred
during examination period across all systems
- 1)
Related KRIs/KPIs: Mean Time to Repair
(MTTR) - All Systems
30. Percent Difference in MTBF
(Monthly)
Definition: The difference in Mean Time
Between Failure (MTBF) from month-to-month
for the group of systems being examined,
measured as a percentage.
Rationale: This metric measures the stability
of systems following a resumption of service
(i.e., a repair following a failure), as well as
the IT function’s ability to regularly develop
and release stable services (initial releases
and changes). The percent difference from
month-to-month for this metric can indicate
the directional performance of the IT team in
releasing, patching and maintaining services
over time (i.e., from one month to the next).
Formula: ((MTBF for Most Recent Month -
MTBF for Previous Month) / MTBF for Previous
Month) * 100
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems
31. Mean Time to Repair (MTTR) -
All Systems
Definition: The average amount of time
(measured in hours) required to repair a
system or application to full functionality
following a failure (i.e., a service interruption),
measured from the time that the failure occurs
until when the repair is completed and rolled
out to all required locations (servers, devices,
workstations, etc.).
31
Rationale: This metric measures the IT
function’s ability to respond to and resolve
a system or application failure, or service
interruption, and ensure that the resolution is
rolled out to all required workstations, devices,
servers, etc. A large value for this metric
may indicate that the IT function’s response
procedures are lacking and/or that systems
are not built in such a way that facilitates
speedy debugging and recovery.
Formula: (Sum of time to repair for all
systems) / (Number of repairs completed
during examination period across all systems)
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems
32. Percent Difference in MTTR
(Monthly)
Definition: The difference in Mean Time to
Repair (MTTR) from month-to-month for the
group of systems being examined, measured
as a percentage.
Rationale: This metric measures the IT
function’s ability to respond to and resolve
a system or application failure, or service
interruption, and ensure that the resolution is
rolled out to all required workstations, devices,
servers, etc. An increasing value for this
metric may indicate that the performance of
the IT team is decreasing, which can be due
to a larger than usual volume of failures (i.e.,
increased workload), hard to resolve failures,
or simply due to poor performance.
Formula: ((MTTR for Most Recent Month -
MTBF for Previous Month) / MTTR for Previous
Month) * 100
Related KRIs/KPIs: Mean Time to Repair
(MTTR) - All Systems
Information Technology (Cont.)
33. System Availability - All
Systems
Definition: The amount of time (measured
in minutes) that ALL systems are online
and available for use by all authorized users
divided by the total amount of time those
systems are scheduled to be available for
use over the same period of time, as a
percentage.
Rationale: This metric measures the
overall performance and uptime of systems.
System service interruptions/failures expose
the company to reputational, financial and
operational risks. This value should be near
100%, as system downtime can directly
relate to lost revenue, poor productivity and
decreased client satisfaction.
Formula: (System Uptime + Scheduled
Maintenance Time) / (System Uptime +
Scheduled Maintenance Time + Unscheduled
Downtime) * 100
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems, Mean Time to
Repair (MTTR) - All Systems
34. System Availability During
Trading Hours - All Systems
Definition: The amount of time (measured
in minutes) that ALL systems are online and
available for use during trading hours (10am-
3pm, Sunday-Thursday) by all authorized
users divided by the total amount of time
those systems are scheduled to be available
for use over the same period of time, as a
percentage.
Rationale: This metric measures the
overall performance and uptime of systems
during peak business hours. System service
interruptions expose the company to
reputational, financial and operational risks.
This value should be near 100%, as system
downtime can directly relate to lost revenue
and decreased client satisfaction.
32
Formula: (System Uptime + Scheduled
Maintenance Time) / (System Uptime +
Scheduled Maintenance Time + Unscheduled
Downtime) * 100
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems, Mean Time to
Repair (MTTR) - All Systems
35. Number of Instances Where
Systems Exceeded Capacity
Requirements
Definition: The total number of instances
(i.e., a specific point in time) where systems
exceeded the pre-defined capacity threshold,
measured in transactions or requests per
second, within the measurement period.
Rationale: This metric measures the
diligence of the organization’s capacity
monitoring practices and the corresponding
adjustments of capacity requirements and
use based on detected patterns. Capacity
constraints can cause performance
degradation and may be a pre-cursor to
failure (i..e, service interruption).
Formula: Count of Instances Where
Requests/Transactions per Second Exceeded
Defined Threshold
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems, Mean Time
Between Failure (MTBF) - All Systems,
System Availability - All Systems
36. Percentage of System/
Application Downtime Caused by
Inadequate Server Capacity
Definition: The amount of system downtime,
or service interruption time, that was caused
specifically by insufficient capacity (i.e.,
requests/transaction load directly caused
failure) as a percentage of total unplanned
downtime within the measurement period.
Information Technology (Cont.)
Rationale: This metric measures the
diligence of the organization’s server capacity
monitoring practices and related risk arising
from services interruptions due to capacity
issues. IT staff should be alerted to capacity
issues in an automated fashion, thus reducing
potential related downtime. Controls should
be put in place to quickly scale up capacity
in order to avoid impending downtime or
performance degradation.
Formula: (Sum of Downtime Caused by
Capacity Issues) / (Sum of Total Unplanned
Downtime Caused by All Issues) * 100
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems, Mean Time
Between Failure (MTBF) - All Systems, System
Availability - All Systems
37. Percentage of Downtime Due to
Scheduled Activities - All Systems
Definition: The total amount of downtime,
measured in minutes, that has been set
aside and used by the IT function for planned
system maintenance activities (as opposed to
unplanned downtime) as a percentage of total
downtime (planned and unplanned) during the
measurement period.
Rationale: This metric measures the amount
of time that the IT team has scheduled for
routine and preventative maintenance to
ensure that systems and applications continue
to perform as intended throughout their life.
While scheduled downtime is unavoidable, it
should be scheduled during times of minimal
activity (both internal and external).
Formula: (Sum of Downtime Caused by
Planned or Scheduled Maintenance Activities /
Total Downtime) * 100
Related KRIs/KPIs: System Availability - All
Systems
33
38. Mean Network Bandwidth
Utilization Rate - Overall (30 Minute
Intervals)
Definition: The average utilization rate
(i.e., percentage of total available network
bandwidth capacity being used), measured as
a ratio of current network traffic to the total
amount of traffic that the network, or port,
being examined can handle.
Rationale: This metric measures the capacity
of the company’s network infrastructure and
the IT function’s ability to monitor and scale
network capacity to avoid instances of network
failure which can lead to financial, reputational
and operational harm. Furthermore, high
network capacity utilization may be indicative
of potential external security risks.
Formula: Sum of Mean Network Bandwidth
Utilization Across All 30 Minute Intervals /
Total Number of 30 Minute Intervals Within
Measurement Period
Related KRIs/KPIs: Number of Instances
Where Network Bandwidth Utilization
Exceeded Threshold
39. Number of Instances Where
Network Bandwidth Utilization
Exceeded Threshold
Definition: The total number of instances
during the measurement period where
network bandwidth capacity exceed a defined
threshold (identified through network testing
and monitoring) at which the network begins
to exhibit request delays, low transmission
speeds, etc.
Rationale: This metric measures the IT
function’s ability to monitor network capacity
and adjust based upon trends in network
utilization and use patterns to ensure that
quality of service remains high. During periods
of increased activity (i.e., near, at or beyond
threshold network utilization), performance
degradation may cause poor customer
experience, lost revenue and/or poor internal
productivity.
Information Technology (Cont.)
Formula: Count of Instances Where Network
Bandwidth Capacity Exceeds Threshold
Related KRIs/KPIs: Mean Network
Bandwidth Utilization Rate - Overall (30
Minute Intervals)
40. Mean Network Hardware
Utilization Rate - Overall (30
Minute Intervals)
Definition: The average utilization rate
(i.e., percentage of total available network
hardware capacity being used), measured as
a ratio of current network traffic to the total
amount of traffic that the network, or port,
being examined can handle.
Rationale: This metric measures the IT
function’s ability to monitor network capacity
and adjust based upon trends in network
utilization and use patterns to ensure that
quality of service remains high. During
periods of increased activity (i.e., near, at
or beyond threshold network utilization),
performance degradation may cause poor
customer experience, lost revenue and/or
poor internal productivity.
Formula: Sum of Mean Network Hardware
Utilization Across All 30 Minute Intervals /
Total Number of 30 Minute Intervals Within
Measurement Period
Related KRIs/KPIs: Number of Instances
Where Network Hardware Utilization
Exceeded Threshold
41. Number of Instances Where
Network Hardware Utilization
Exceeded Threshold
Definition: The total number of instances
during the measurement period where
network hardware capacity exceed a defined
threshold (identified through network testing
and monitoring) at which the network begins
to exhibit request delays, low transmission
speeds, etc.
34
Rationale: This metric measures the IT
function’s ability to monitor network capacity
and adjust based upon trends in network
utilization and use patterns to ensure that
quality of service remains high. During
periods of increased activity (i.e., near, at
or beyond threshold network utilization),
performance degradation may cause poor
customer experience, lost revenue and/or
poor internal productivity.
Formula: Count of Instances Where Network
Hardware Capacity Exceeds Threshold
Related KRIs/KPIs: Mean Network
Hardware Utilization Rate - Overall (30 Minute
Intervals)
42. Percentage of System Releases
Not Mirrored on Backup Systems
Within 24 Hours Following Launch
- All Systems
Definition: The number of releases that
were successfully launched to the live
environment that were not mirrored on
backup systems within 24 hours following the
successful launch as a percentage of total
changes successfully performed during the
measurement period.
Rationale: This metric measures the IT
function’s adherence to backup procedures
and protocols. Failure to backup successful
releases in a timely fashion can lead to data
loss, rework and future downtime (both
internal and customer-facing). Backups of this
scale should be automated and/or built into
the release process to ensure that they are
done in a timely fashion with minimal human
intervention required.
Formula: (Number of Successful Releases
Not Backed up Within 24 Hours / Total
Number of Successful Releases) * 100
Related KRIs/KPIs: Percentage of Systems
Undergoing New Releases - All Systems
Information Technology (Cont.)
43. Percentage of System Changes
Not Mirrored on Backup Systems
Within 24 Hours Following Launch -
All Systems
Definition: The number of system changes
that were successfully launched to the live
environment that were not mirrored on
backup systems within 24 hours following the
successful launch as a percentage of total
changes successfully performed during the
measurement period.
Rationale: This metric measures the IT
function’s adherence to backup procedures
and protocols. Failure to backup successful
changes in a timely fashion can lead to data
loss, rework and future downtime (both
internal and customer-facing). Backups of this
scale should be automated and/or built into
the change process to ensure that they are
done in a timely fashion with minimal human
intervention required.
Formula: (Number of Successful Changes Not
Backed up Within 24 Hours / Total Number of
Successful Changes) * 100
Related KRIs/KPIs: Percentage of Systems
Undergoing Changes - All Systems
44. Percentage of Critical Systems
without Up-to-Date Patches
Definition: The total number of critical
systems (all deployed instances of the system
or application running on each device/
workstation) that do not currently have up-
to-date patches installed and running as a
percentage of total critical system end user
devices/workstations. This metric may also be
known as “Patch Coverage Rate.”
Rationale: This metric measures the IT
function’s ability to efficiently and successfully
roll out patches to all required end points.
Poor patch and change management practices
expose the company to risk related to un-
patched security vulnerabilities and system/
application shortcomings (instability, poor user
experience, etc.).
35
Formula: (Number of Systems without Most
Recent Patch Running / Total Number of
Critical Systems Running) * 100
Related KRIs/KPIs: Percentage of Changes
Considered Emergency Changes
45. Percentage of Critical System
Backups that are Not Fully
Automated
Definition: The number of critical systems
without an automated (i.e., no manual work
required) backup currently configured and
running accurately as a percentage of total
critical system backups (automated and
manual).
Rationale: This metric measures the IT
function’s backup management practices and
risk related to data loss or system/application
downtime related to out of date backups.
Highly manual backup management practices
also leaves the organization open to human
error. Automated backups should be managed
through a central application, and notifications
should be send to administrators when
backups are not run successfully, or when a
change to backup configuration is detected.
Formula: (Number of Critical System Backups
That are Not Automated / Total Number of
Critical System Backups) * 100
Related KRIs/KPIs: Percentage of Critical
System Backups that are Automated, Critical
System Backup Failure Rate, Percentage of
Critical Systems with Backups Performed
Within Threshold
46. Total Number of Critical System
Backup Failures
Definition: The total number of critical system
backup processes that failed (i.e., did not run,
were not captured in-full, were captured with
errors, etc.) to complete or run properly during
the measurement period.
Information Technology (Cont.)
Rationale: This metric measures the
IT function’s ability to configure backup
processes that run successfully with minimal
intervention. Poor backup management
exposes the company to risk related to lost
data and system downtime (internal and
external). Backups should be configured
to run with little or no human interaction.
Furthermore, backups must be monitored to
ensure that they are taken before and after
each instance of a release or change. This is
particularly important for critical systems.
Formula: Number of Attempted Critical
System Backups That Resulted In a Failure
Related KRIs/KPIs: Percentage of Critical
System Backups that are Automated, Critical
System Backup Failure Rate, Percentage of
Critical Systems with Backups Performed
Within Threshold
47. Percentage of Workstations
that have Not Received a Full
Malware Scan Within Last 24
Hours
Definition: The number of workstations that
have not undergone a full, successful virus
scan with that last 24 hours as a percentage
of total active workstations managed by the
organization.
Rationale: This metric measures the
IT function’s established practices and
adherence to malware and virus scanning
procedures. Poor controls in this area leave
the company open to malware infections
which can lead to data leaks, stolen
credentials, performance degradation, etc.
These risks are easily avoidable through
discipline in this area.
Formula: (Number of Workstations Where
Full Malware Scan Has Not Been Performed
Within Last 24 Hours / Total Number of
Workstations Managed by the Organization)
* 100
Related KRIs/KPIs: Percentage of
Workstations Not Running Updated Anti-
Malware Controls
36
48. Percentage of Servers that
have Not Received a Full Malware
Scan Within Last 24 Hours
Definition: The number of servers that
have not undergone a full, successful virus
scan with that last 24 hours as a percentage
of total active servers managed by the
organization.
Rationale: This metric measures the
IT function’s established practices and
adherence to malware and virus scanning
procedures. Poor controls in this area leave
the company open to malware infections
which can lead to data leaks, stolen
credentials, performance degradation, etc.
These risks are easily avoidable through
discipline in this area.
Formula: (Number of Servers Where Full
Malware Scan Has Not Been Performed
Within Last 24 Hours / Total Number of
Servers Managed by the Organization) * 100
Related KRIs/KPIs: Percentage of Servers
Not Running Updated Anti-Malware Controls
49. Percentage of Mobile Devices
that have Not Received a Full
Malware Scan Within Last 24
Hours
Definition: The number of mobile devices
that have not undergone a full, successful
virus scan with that last 24 hours as a
percentage of total active mobile devices
managed by the organization.
Rationale: This metric measures the
IT function’s established practices and
adherence to malware and virus scanning
procedures. Poor controls in this area leave
the company open to malware infections
which can lead to data leaks, stolen
credentials, performance degradation, etc.
These risks are easily avoidable through
discipline in this area.
Formula: (Number of Mobile Devices Where
Full Malware Scan Has Not Been Performed
Within Last 24 Hours / Total Number of
Mobile Devices Managed by the Organization)
* 100
Information Technology (Cont.)
Related KRIs/KPIs: Percentage of Devices
Not Running Updated Anti-Malware Controls
50.Percentage of Devices Not
Running Updated Anti-Malware
Controls
Definition: The number of devices
(workstations, servers, mobile devices)
managed by the company that are not
currently running fully up-to-date anti-malware
protection as a percentage of total devices
managed by the organization.
Rationale: This metric measures the IT
function’s diligence in ensuring that devices
are running compliant anti-malware software
at all times. Lack of diligence in this area leads
to avoidable risk related to data leaks, misuse
of data, stolen credentials, performance
degradation, and other internal/external
threats.
Formula: (Number of Devices Not Running
Compliant and Up-to-Date Malware Protection
/ Total Number of Devices Managed by the
Organization) * 100
Related KRIs/KPIs: Percentage of Devices
that have Not Received a Full Malware Scan
Within Last 24 Hours
51. Percentage of Workstations
Not Running Updated Anti-Malware
Controls
Definition: The number of workstations
managed by the company that are not
currently running fully up-to-date anti-
malware protection as a percentage of active
workstations managed by the organization.
Rationale: This metric measures the
IT function’s diligence in ensuring that
workstations are running compliant anti-
malware software at all times. Lack of
diligence in this area leads to avoidable risk
related to data leaks, misuse of data, stolen
credentials, performance degradation, and
other internal/external threats.
37
Formula: (Number of Workstations Not
Running Compliant and Up-to-Date Malware
Protection / Total Number of Workstations
Managed by the Organization) * 100
Related KRIs/KPIs: Percentage of
Workstations that have Not Received a Full
Malware Scan Within Last 24 Hours
52. Percentage of Servers Not
Running Updated Anti-Malware
Controls
Definition: The number of servers managed
by the company that are not currently running
fully up-to-date anti-malware protection as a
percentage of total active servers managed by
the organization.
Rationale: This metric measures the IT
function’s diligence in ensuring that servers
are running compliant anti-malware software
at all times. Lack of diligence in this area leads
to avoidable risk related to data leaks, misuse
of data, stolen credentials, performance
degradation, and other internal/external
threats.
Formula: (Number of Servers Not Running
Compliant and Up-to-Date Malware Protection
/ Total Number of Servers Managed by the
Organization) * 100
Related KRIs/KPIs: Percentage of Servers
that have Not Received a Full Malware Scan
Within Last 24 Hours
53. Percentage of Mobile Devices
Not Running Updated Anti-Malware
Controls
Definition: The number of mobile devices
managed by the company that are not
currently running fully up-to-date anti-malware
protection as a percentage of active mobile
devices managed by the organization.
Information Technology (Cont.)
Rationale: This metric measures the IT
function’s diligence in ensuring that mobile
devices are running compliant anti-malware
software at all times. Lack of diligence in this
area leads to avoidable risk related to data
leaks, misuse of data, stolen credentials,
performance degradation, and other internal/
external threats.
Formula: (Number of Mobile Devices Not
Running Compliant and Up-to-Date Malware
Protection / Total Number of Mobile Devices
Managed by the Organization) * 100
Related KRIs/KPIs: Percentage of Mobile
Devices that have Not Received a Full
Malware Scan Within Last 24 Hours
54. Percentage of Firewall Rules
Added or Changed Within Last
90 Days That Were Formally
Documented
Definition: The number of changes to firewall
rules that were applied to the company’s
firewall (across all firewall applications/
systems in use) that were formally
documented according to the company’s
policies/procedures as a percentage of total
firewall rule changes applied within the last
90 calendar days.
Rationale: This metric measures the
IT function’s protocols related to firewall
rule change and addition documentation.
Poor documentation related to firewall rule
documentation may leave the company
open to risk related to firewall rules that may
conflict with others, or may not be compliant
with certain internal or external protocols
(e.g., PCI DSS, etc.).
Formula: (Number of Firewall Rule Changes
or Additions Formally Documented / Total
Number of Firewall Changes or Additions) *
100
Related KRIs/KPIs: Number of Unused
Firewall Rules, Average Time Elapsed
Between Formal Reviews of Firewall Rules
38
55. Percent Increase in Number of
Attacks on Firewall (Weekly)
Definition: The percent difference in the
number of attacks on the company’s firewall
that were detected during the previous two
calendar weeks.
Rationale: This metric measures the
change in malicious activity detected by
the company’s firewall protection protocols.
A large increase in attacks against the
company’s firewall may indicate that certain
firewall are in need of review due to a
potential vulnerability, or that the organization
is increasingly becoming the target of
malicious outside attacks.
Formula: ((Number of Firewall Attacks During
Most Recent Week - Number of Firewall
Attacks During Previous Week) / Number of
Firewall Attacks During Previous Week) * 100
Related KRIs/KPIs: Number of Firewall
Reviews Conducted, Average Time Elapsed
Between Formal Reviews of Firewall Rules
56. Number of Unused Firewall
Rules
Definition: The total number of firewall rules
(across all firewall applications/systems in
use) that were found to no longer be in use
during formal or informal firewall rule reviews
conducted during the measurement period.
Rationale: This metric measures the IT
function’s protocols related to ensuring
that unused or expiring firewall rules are
continuously refreshed and audited. Unused
firewall rules may leave the door open for
malicious attacks, conflict with other rules
rendering them useless, and/or degrade
firewall performance. For example, an
outdated firewall rule may have left a port
open for an internal application that is no
longer in use, allowing data to flow out of the
organization through that port.
Formula: Count of Unused or Expired Firewall
Rules Identified
Information Technology (Cont.)
Related KRIs/KPIs: Average Time Elapsed
Between Formal Reviews of Firewall Rules,
Percentage of Firewall Rules Added or
Changed Within Last 90 Days That Were
Formally Documented
57. Number of Firewall Reviews
Conducted
Definition: The total number of formal firewall
configuration reviews conducted by IT team
members during the measurement period.
Rationale: This metric measures the IT
function’s standard procedures related to
formal firewall rule reviews. Firewall rule
reviews may identify the need for additional
rules and also point out unused rules - both
of these actions improve overall security,
improve firewall performance, and ensure that
unused rules (open ports, etc.) cannot be used
by external attackers to facilitate the flow of
information out of the organization.
Formula: Count of Formal Firewall Reviews
Conducted
Related KRIs/KPIs: Average Time Elapsed
Between Formal Reviews of Firewall Rules
58. Average Time Elapsed Between
Formal Reviews of Firewall Rules
Definition: The average number of calendar
days elapsed between formal firewall rules
reviews conducted by the company to
determine if rules must be added, removed or
edited to meet current operating requirements.
Rationale: This metric measures the IT
function’s standard procedures related to
formal firewall rule reviews. Firewall rule
reviews may identify the need for additional
rules and also point out unused rules - both
of these actions improve overall security,
improve firewall performance, and ensure that
unused rules (open ports, etc.) cannot be used
by external attackers to facilitate the flow of
information out of the organization.
Formula: Number of Calendar Days During
Measurement Period / (Number of Formal
Firewall Rule Reviews Conducted During
Measurement Period )
39
Related KRIs/KPIs: Percentage of Firewall
Rules Added or Changed Within Last 90 Days
That Were Formally Documented, Number of
Unused Firewall Rules
59. Number of Servers
Experiencing Hardware-related
Performance Issues Within the Last
90 Days
Definition: The number of servers that have
experienced hardware-related performance
issues during the last 90 calendar days as a
percentage of total servers operated by the
company.
Rationale: This metric measures the
performance, maintenance and overall
health of the company’s servers. Poor server
performance can directly lead to application
performance issues, website slow downs,
and low productivity. These items, in turn,
can open the company up to risk related
to poor customer service/experience, lost
revenue and/or increased probability of server
failure leading again to lost information and/
or revenue.
Formula: Count of Servers Experiencing
Performance Issues
Related KRIs/KPIs: Percentage of Servers
that have Received a Full Malware Scan Within
Last 24 Hours
60. Number of Workstations
Experiencing Hardware-related
Performance Issues Within the Last
90 Days
Definition: The number of individual
workstations that have experienced
performance issues during the last 90
calendar days as a percentage of total
workstations operated by the company.
Information Technology (Cont.)
Rationale: This metric measures the
performance, maintenance and overall
health of the workstations managed by
the organization. Excessive workstation
performance issues may lead to low
productivity, issues fulfilling customer
requests and loss of information. These
issues, in turn, can indirectly lead to lost
revenue, customer dissatisfaction and
avoidable costs related to correcting
performance issues and replacing
workstations.
Formula: Count of Workstations Experiencing
Performance Issues
Related KRIs/KPIs: Percentage of
Workstations that have Received a Full
Malware Scan Within Last 24 Hours
61. Deployed Hardware Utilization
Ratio (DH-UR)
Definition: The ratio of number of servers
that are running live applications used by the
organization to the total number of servers
currently managed, or deployed by the
organization at the time of measurement.
Rationale: This metric measures the amount
of data center energy being used to power
servers that are not used to run applications.
A value for this metric that is too high may
be indicative of an impending power failure
or overload due to mis-managed data center
energy, which can cause catastrophic
downtime, leading to lost revenue, poor
customer experience, low productivity and
reputational harm.
Formula: Number of Servers Running Live
Applications / Total Number of Servers
Deployed
Related KRIs/KPIs: Percentage of Critical
Systems with Backups Performed Within
Threshold
40
Telecommunications &
Connectivity Risks
62. Network Availability
Definition: The amount of time (measured
in minutes) that the company’s network
is available for use by all authorized users
divided by the total amount of time the
network is scheduled to be available for
use over the same period of time, as a
percentage.
Rationale: This metric measures the overall
performance and uptime of the company’s
network. Network interruptions/failures
expose the company to reputational, financial
and operational risks. This value should be
near 100%, as network downtime can directly
relate to lost revenue, poor productivity and
decreased client satisfaction.
Formula: (Network Uptime + Scheduled
Maintenance Time) / (Network Uptime +
Scheduled Maintenance Time + Unscheduled
Downtime) * 100
Related KRIs/KPIs: Mean Time Between
Failure (MTBF) - All Systems, Mean Time to
Repair (MTTR) - All Systems
63. Percentage of Network
Devices Not Meeting Configuration
Standards
The total number of network devices
(modems, routers, switches, etc.) that were
found not to be in compliance the company’s
pre-defined configuration standards as a
percentage of total network devices under
management at the same point in time.
Rationale: This metric measures the IT
function’s diligence in ensuring that network
devices are configured properly. Improper
configuration can lead to increased risk
related to security incidents (internal and
external), network performance degradation
and network outages.
Information Technology (Cont.)
Formula: (Number of Network Devices Not
Meeting All Configuration Standards / Total
Number of Network Devices Managed) * 100
Related KRIs/KPIs: Mean Network
Bandwidth Utilization Rate - Overall (30
Minute Intervals), Number of Instances Where
Network Bandwidth Utilization Exceeded
Threshold

64. Number of Network Outages

Attributed to Internet Service
Provider
The number of network outages that can be
attributed to the company’s Internet Service
Provider (ISP), rather than an internal source,
during the measurement period.
Rationale: This metric measures the
quality and reliability of service related to
the company’s ISP. ISP network outages
leave the company open to risk related to
low productivity, poor customer service/
experience, loss of data/information and loss
of revenue. ISP service issues are particularly
worrisome because they are almost wholly out
of the company’s control (i.e., managed by an
external third party).
Formula: Count of Network Outage Events
Where ISP is Responsible Party
Related KRIs/KPIs: Percentage of Network
Devices Meeting Configuration Standards

41
You can’t manage risk
without knowing what
to measure.
Our standard IS & IT Key Risk
Indicators help organizations
quantify and monitor risk.
Building a world-class risk
management function requires
analytics and dashboards to
stay ahead of potential threats.
OpsDog can help you get there.
Call OpsDog at 844.650.2888 or
e-mail us at info@opsdog.com

This content may not be copied, distributed, republished, uploaded, posted

or transmitted in any way without the prior written consent of OpsDog, Inc.