Overview / Goal
Provide a concise, executive-ready KPI set that proves controls are effective, demonstrates improving security posture, and supports audit evidence.
Core KPIs & Definitions
- Control Coverage: % of in-scope assets/processes with required control implemented
text
Control Coverage = (Number of assets with control implemented / Total in-scope assets) * 100%
- Mean Time to Detect (MTTD): average time from incident start or control failure to detection
text
MTTD = Sum(detection time - start time) / Number of incidents
- Mean Time to Remediate (MTTR): average time from detection to remediation/closure
text
MTTR = Sum(remediation time - detection time) / Number of incidents
- Remediation Velocity: % of findings closed within SLA window (e.g., 30/60/90 days)
- Evidence Freshness: median age of supporting evidence per control (days)
- Control Exception Trend: rolling 90-day count and severity-weighted rate of exceptions
Supporting Metrics
- False-positive rate (detection quality)
- Repeat-finding rate (recurrence)
- Audit pass-rate by control family
Dashboard Layout (Executive / Audit Tabs)
- Top row (Executive summary): Overall Risk Score, Control Coverage, MTTD, MTTR, Remediation Velocity (gauges)
- Middle row: Trend charts (30/90/365 days) for MTTD, MTTR, Exceptions by severity
- Lower row: Heatmap of coverage by business unit, evidence freshness table, top 10 open findings with age and owner
- Audit view: Per-control evidence links, timestamped evidence history, exception approvals
Thresholds / Targets
- Set targets by risk tier:
- Critical controls: Coverage >= 99%, MTTD < 1 hour, MTTR < 24 hours, Remediation Velocity 95% within SLA
- High: Coverage >= 95%, MTTD < 4 hours, MTTR < 72 hours, Remediation Velocity 90%
- Medium/Low: progressive relaxed targets
- Evidence Freshness target: < 30 days (or per control-specific cadence)
- Exception trend: target zero increasing trend; define alert when 3-month trend slope > +10%
Implementation & Governance
- Map KPIs to control owners, automate data collection from SIEM, GRC, ticketing, CMDB
- Quarterly review with execs + monthly operational review
- Use targets as control SLAs; escalate deviations via RACI and runbooks
Why this works: combines coverage, speed, quality, and evidence to show both technical effectiveness and auditability, with thresholds tied to business risk.
