The ultimate goal of metrics and controls and of the entire security organization is to lower risk to a palatable level for the business. These metrics will allow you to report risks to the business in ways that will resonate with boards. The industry often relies on numbers like 300,000 malware alerts to explain risks. These quantitative terms offer little context for the listener, but its important to tie risks to specific information assets. For KRIs to be meaningful, we need to better understand what we are to protect. We must create BusinessAs to what the company cares about.”]