A proxy metric, also called an indirect metric, uses another business measurement to provide cybersecurity insight. It is most useful alongside direct measurements, which are collected directly, and derived metrics, which combine measurements. A proxy adds context; it should not be treated as proof that a security initiative caused a result. section 1.1
Choose a proxy that answers a decision question:
- Risk management: Compare changes in cybersecurity insurance premiums with incident history. Track incident counts separately so the financial signal does not obscure the underlying trend. section 5.3.2
- Supply chain risk: Aggregate regular third-party cybersecurity audit scores, if a workable method exists. The result may indicate security posture and identify areas for investigation. section 5.7.2
- Platform operations: Follow system uptime and resource usage over time to spot patterns, including seasonal or event-related peaks. section 7.4.6
Interpreting an insurance change
If premiums change after a cybersecurity initiative, report the change alongside incident frequency and the available incident history. The premium is a financial signal worth investigating, not a standalone measure of incidents prevented or a definitive return on investment. section 5.3.2
Collect a proxy only when its decision value justifies the effort of maintaining it. State what it suggests, which direct or derived metrics provide context, and what needs further investigation before resources are committed. section 1.1 section 5.8
