Board members are seeking a better understanding of the potential for cybersecurity initiatives to enhance their companys strategic operations. Security professionals need to be able to answer these questions and help board members understand that cybersecurity does not control the threat landscape facing the company. The purpose of a mature cybersecurity program is to provide the business with a platform to manage its risk environment. There is no specific template for what should be measured with metrics; every company’s business environment is different. Connecting metrics to the business will help to prioritize resources more efficiently.”]
Source: https://www.csoonline.com/article/3253332/security-metrics-telling-your-value-story.html