A direct metric is collected and measured directly, rather than calculated from other metrics. The number of identity and credential management incidents in a year is direct; a ratio of successful to failed authentication attempts is derived. Direct measures give security teams observable starting points for assessing risk, but their value depends on the decision they support. section 1.1 section 5.8
Choose direct metrics around the question at hand:
- Risk management: count identified, addressed, and overdue risks at each risk-register review. Examine severity and due dates before deciding which work needs attention. section 5.3.2
- Supply chain: count third parties, completed evaluations, and reported incidents. Group vendors by criticality; incident counts may be incomplete when disclosure is not required. section 5.7.2
- Adverse events: measure time to detect, time to respond, and event volume. These show different parts of the detection and response process. section 8.6.1
From an inventory count to a decision
Suppose an organization records 100 hardware assets, including 30 critical assets. Both counts are direct metrics; the 30% critical-to-total ratio is derived. The counts establish the inventory, while the critical designation helps focus security effort on equipment essential to operations. section 6.2.1
Report a direct metric with its time period, relevant context, and proposed action. A growing count of overdue risks, for example, warrants a look at causes in the risk register and whether resources need realignment—not a conclusion based on the count alone. section 5.3.2
