NORAD’s front page states: What are some control-compliant or input metrics for NORAD? These are all interesting metrics. You might see some comparisons to metrics you might track, like percentage of hosts with anti-virus. But do any of those metrics tell you if NORAD is accomplishing its mission? In other words, what is theof all those metrics? Here are some field-assessed or outcome-based metrics. These metrics address the critical concern:Keep these in mind when you are devising metrics for your digital security program.”]
Source: https://taosecurity.blogspot.com/2007/07/norad-inspired-security-metrics.html