Rebecca Herold developed a metrics program for the information security department at the Principal Financial Group. Her metrics program would keep track of how many employees visited the groups intranet webpage. She also did similar walk throughs before AND after information security awareness training, to measure the effectiveness of the training. Herold said the measurements, once established, should be something you stick with, so choose something to measure that is sustainable over time. Metrics can be a double-edged sword, Herold noted.”]
Source: https://www.cuinfosecurity.com/how-does-your-information-security-program-measure-up-a-531