A derived metric combines other measurements or data over time to add meaning. Unlike a direct metric, which is collected as measured, it can express a ratio, percentage, or average. The ratio of successful to failed authentication attempts is one example. section 1.1
Choose a calculation that answers a decision-making question:
- Risk management: compare identified and addressed risks, or track average risk treatment time. A rising treatment time may signal a need to examine resources, expertise, tools, or the process. section 5.3.2
- Governance: compare open with closed board action items and on-time with slipped items to assess progress and where follow-up is needed. section 5.4.1
- Detection: track false positive rate to assess alert accuracy and potential alert fatigue, rather than reporting alert volume alone. section 8.6.1
From inventory counts to a proportion
If 30 of 100 hardware assets are critical, the critical-to-total hardware asset ratio is 30%. This puts the count of critical assets in the context of the whole inventory. The same measure can be made for software assets. section 6.2.1
Checking whether incident response improves
A firm initially averaged eight hours to contain an incident and reported a 60% incident response success rate. After refining its response processes for six months, average containment time fell to three hours. Comparing these derived measures over time helps assess whether changes are working; the figures alone do not identify which change caused the improvement. section 9.9.1
Figure 9.6 On the left side, CyberSecure Solutions’ incident response dashboard is shown before implementing incident response strategies and process improvements. The right side shows the incident response dashboard after the implementation of these strategies and improvements.
The before-and-after incident response dashboards show how derived measures can make process improvement visible to decision-makers. section 9.9.1
Derive and maintain a metric when its insight is worth the collection effort. Pair the result with its business context: a percentage of third parties meeting security requirements, for example, helps assess the supply chain risk management process, but an evaluation may take time when a vulnerability is difficult to patch. section 5.4.1 section 5.7.2
