Was sind die Best Practices, um genaue und zuverlässige ISMS-Metriken zu gewährleisten?

An ISMS should be implemented to support business goals/ objectives. Therefore, to deliver value, there must be alignment between information security strategies and business strategic objectives. The best way to ensure this alignment is by cascading down or translating the business goals and objectives to information security goals and strategies. While it's easier to make use of quantitative metrics, the organisation can also use qualitative metrics to measure the effectiveness of its security programme. The main challenge of qualitative metrics is that they are difficult to measure or track. Examples: -improved confidence in security posture -increased customer satisfaction in our services -improved user awareness of security risks

The initial thing you need to do to create useful measurements is to set clear and specific goals for your Information Security Management System (ISMS). Make sure these goals match up with what your business aims to achieve, how much risk you're okay with, and any rules you have to follow. It's important that these goals are SMART: Specific: Clearly define what you want to achieve Measurable: Establish criteria to quantify your progress. Achievable: Ensure that your goal is realistic and attainable. Relevant: Align your goal with your overall objectives. It should make sense in the context of your broader plan. Time-Bound: Set a specific timeframe for achieving your goal.

There are two types of indicators that can be used, i.e. lead and lag indicators. Lead indicators measure activities and processes that are predictive of future security outcomes or that are indicative of a successful ISMS. They help organizations to identify the areas that are working well in mitigating risks and preventing breaches. Lag indicators help us to track progress over time and to identify gaps in our ISMS or areas that require improvement.

After defining your objectives, the next step is selecting indicators to measure progress. These indicators, categorized into input (resources invested), output (immediate results), and outcome (final impacts), reflect your Information Security Management System's performance. They provide a comprehensive view of your progress at various stages, helping you assess the effectiveness of your security measures.

Examples of lead and lag indicators: Lead indicators: - Number of incidents or breaches reported, investigated and resolved - Number of staff members who participated in security awareness sessions - Number of security vulnerabilities addressed - Number of security policies/ procedures reviewed and updated - Customer/ employee satisfaction with security posture - Number/ percentage of security patches applied Lag indicators: - Number of security breaches recorded - Number of security incidents or near-misses - Financial loss from incidents/ breaches - Percentage downtime resulting from breaches and security incidents - Number of failed transactions/ processes due to security issues - Level of non-compliance with regulatory requirements

Following the selection of indicators, the third step involves gathering and examining data related to these indicators. This process includes several key considerations: Data Collection: Define sources and methods. Specify collection frequency. Roles and Responsibilities: Assign clear roles. Outline responsibilities. Data Quality Measures: Use standardized tools and formats. Implement consistent procedures. Analysis Techniques: Apply statistical and trend analysis. Utilize benchmarking. Comparison: Evaluate against targets and baselines. Benchmark with industry standards.

Choose a mix of indicators, that are operational, tactical and strategic. These will be technical and organizational. Translate the data from the technical metrics to a “language” that makes them understandable by your audience, i.e. both technical and nontechnical roles. To demonstrate the organizational support, align your indicators and metrics towards the business objectives. I.e. measure to demonstrate how you support your business stakeholders and the organization. The most effective way to “find” these metrics is to discuss with those you are there to support —> the “business stakeholders”. Let them explain for you what and why security is important for them. Summary: Cybersecurity is a supporting function in an organization.

Review and improve your metrics periodically. You should evaluate the effectiveness, efficiency, and relevance of your metrics, and make adjustments or changes as needed. This can help you to ensure that your metrics are aligned with your objectives, reflect the current state of your ISMS, and provide useful insights for decision making.