A widely accepted management principle is that an activity cannot be managed if it cannot be measured. Security falls under this rubric. Metrics can be an effective tool for security managers to discern the effectiveness of various components of their security programs, the security of a specific system, product or process, and the ability of staff or departments within an organization to address security issues for which they are responsible.
Metrics can also help identify the level of risk in not taking a given action, and in that way provide guidance in prioritizing corrective actions. Additionally, they may be used to raise the level of security awareness within the organization.
Knowledge gained through metrics, security managers can better answer hard questions from their executives and others, such as: