# 9 Metrics & Success Criteria

# 9. Metrics & Success Criteria

Principle: Measure outcomes, not activity.

Examples

• % of critical assets with defined owners
• Number of high risks accepted vs mitigated
• Incident detection time (MTTD)
• Compliance audit results
• Security awareness completion rate