PERFORMANCE MEASUREMENT FOR INFORMATION TECHNOLOGY

What are IT Metrics?

IT metrics are measurable indicators used to evaluate the performance and effectiveness of an
organization’s IT systems, operations, and strategies. They provide tangible data that helps IT
and business leaders assess how well technology initiatives support overarching business
objectives. While IT metrics broadly measure performance, KPIs are specific, strategic metrics
that focus on the success of critical goals within an IT strategy.

The role of IT metrics and KPIs is multifaceted. First, they act as benchmarks for evaluating the
health of IT systems. Metrics like system uptime, response times, and incident resolution rates
give IT leaders a clear picture of operational efficiency.

Second, IT metrics help organizations align their technology investments with business goals.
For example, tracking user satisfaction or technology adoption rates highlights the impact of IT
initiatives on customer experience and employee productivity.

Finally, IT metrics are essential for fostering accountability. By monitoring KPIs, organizations
can establish performance expectations for IT teams and service providers.

Why Use IT Metrics?

In today’s complex digital environments, IT metrics provide the foundation for measuring,
managing, and optimizing performance. They transform raw operational data into actionable
insights, ensuring IT not only maintains technical excellence but also drives business impact.

By leveraging metrics, organizations can better align IT initiatives with strategic priorities,
optimize resource allocation, and build trust with stakeholders.

 Performance Evaluation: By monitoring uptime, response times, error rates, and

throughput, organizations can quickly identify areas for improvement, track progress over
time, and maintain high service quality.
 Business Alignment: Whether it’s reducing downtime that impacts revenue, speeding up
employee productivity, or enhancing customer experience, IT metrics provide tangible
evidence of business value and strategic alignment.
 Decision Making: With reliable data in hand, IT leaders can make informed decisions
about resource allocation, technology investments, and process improvements. For
example, usage and capacity metrics may highlight when it’s time to scale infrastructure,
while cost metrics can guide budget optimization.
  Accountability: By setting measurable benchmarks, organizations can ensure
accountability, monitor service-level agreements (SLAs), and foster a culture of
continuous improvement across IT operations. ‍
 Communication: IT metrics help IT leaders demonstrate the value of their initiatives,
secure executive buy-in, and strengthen collaboration by providing an objective, data-
driven foundation for discussions.

Importance of Tracking IT Metrics

Tracking IT metrics is a critical practice for IT leaders and professionals aiming to optimize
operations, make informed decisions, and align IT strategies with broader business objectives. IT
metrics offer a data-driven approach to understanding performance, identifying inefficiencies,
and driving continuous improvement. Here’s why monitoring IT metrics matters:

 Enhancing Operational Efficiency

IT metrics help organizations improve operations by optimizing resource utilization and

minimizing inefficiencies. For example, tracking system uptime and incident resolution times
can highlight performance bottlenecks and areas for improvement.

Metrics like capacity utilization enable IT teams to balance workloads across servers and
networks, preventing under or over-utilization of resources. By addressing inefficiencies
revealed through metrics, IT departments can reduce costs, improve system reliability, and
ensure smoother operations, directly contributing to overall organizational efficiency.

 Supporting Data-Driven Decision-Making

In modern IT environments, data is essential for making informed decisions. Metrics such as
technology adoption rates, cybersecurity incident frequency, and IT operational costs provide
valuable insights into system performance and potential areas of improvement.

These data points help IT leaders prioritize investments, allocate budgets effectively, and identify
which technologies deliver the greatest ROI. For instance, by analyzing application performance
metrics, IT professionals can decide whether to upgrade infrastructure or implement new
software solutions. Data-driven decision-making ensures IT resources are strategically deployed
to maximize impact.

 Aligning IT Performance with Business Objectives

Aligning IT metrics with business goals ensures that IT efforts contribute directly to
organizational success. Metrics such as user satisfaction scores, response and resolution times,
and error rates showcase how IT services support customer satisfaction, revenue growth, and
operational scalability.

By linking IT performance to key business outcomes, IT departments demonstrate their value as

strategic partners rather than just operational support units. For example, tracking IT operational
costs alongside revenue trends can reveal how technology investments impact the bottom line.

Tracking IT metrics isn’t just about measuring IT performance—it’s about creating a transparent,
data-driven framework that connects IT initiatives with broader organizational goals. This
approach fosters accountability, optimizes resource use, and ultimately drives business success.

Challenges in IT Metrics Management

Managing IT metrics effectively can be a complex endeavor for IT leaders and professionals.
While metrics provide valuable insights, challenges like data collection issues, an overwhelming
number of metrics, and concerns over data reliability can hinder their effectiveness.
Understanding and addressing these challenges is crucial for deriving meaningful value from IT
metrics. Common challenges with IT metrics include:

 Overcoming Data Collection Obstacles

One of the most significant challenges in IT metrics management is validating the accuracy and
availability of data. Gaps in data collection can stem from outdated systems, fragmented tools, or
inconsistent reporting processes. For example, incomplete data on system uptime or incident
resolution times can lead to skewed analyses and poor decision-making.

To overcome these obstacles, organizations should adopt integrated IT performance monitoring

tools that centralize data from various sources. Automating data collection processes also
reduces the risk of human error and ensures timely updates. Additionally, conducting regular
audits of data sources can identify and rectify discrepancies, to make sure metrics accurately
reflect IT performance.

 Avoiding Metric Overload

Tracking too many metrics can dilute focus and create unnecessary complexity. While it may be
tempting to monitor every possible KPI, focusing on the most relevant metrics ensures clarity
and actionable insights. For example, instead of tracking a long list of IT operational costs,
prioritize metrics that align with organizational objectives, such as cost per user or ROI on IT
investments.

To avoid metric overload, organizations should prioritize quality over quantity by selecting
metrics that are directly tied to business goals. Conducting a periodic review of tracked metrics
can help identify redundant or less impactful ones, allowing IT teams to concentrate on those that
matter most.

 Ensuring Data Accuracy and Reliability

Accurate and reliable metrics are essential to effective IT strategy management. Data
inaccuracies can arise from system errors, inconsistencies in reporting, or lack of verification
processes. For example, unreliable user satisfaction scores or cybersecurity incident frequency
data can misguide strategic decisions.

Leveraging advanced IT monitoring and analytics tools can help verify and validate data by
cross-referencing multiple sources. Implementing data governance frameworks ensures
consistent data handling practices and builds trust in the metrics being reported. Regularly
calibrating tools and processes further improves data reliability, helping IT teams make
confident, informed decisions.

IT Metrics vs. IT KPIs

While often used interchangeably, IT metrics and IT Key Performance Indicators (KPIs) serve
different purposes in managing technology performance and outcomes.

IT Metrics represent raw, quantifiable data points that describe how systems, services, or
processes are performing. Examples include server uptime percentages, average ticket resolution
time, or bandwidth utilization. Metrics are detailed, ongoing measurements that provide the
foundation for tracking IT operations and spotting performance trends.

IT KPIs, on the other hand, are a subset of metrics selected for their strategic importance. They
are tied directly to business objectives and provide a high-level view of whether IT is
contributing to organizational goals. For instance, while mean time to resolution (MTTR) is a
metric, a KPI might be “reduce MTTR by 20% within the next quarter” to improve customer
satisfaction and operational efficiency.

In short:

 Metrics = detailed operational data (the “what”).

 KPIs = targeted, business-aligned indicators (the “so what”).
By combining both, IT leaders gain a comprehensive picture: metrics deliver granular insight,
while KPIs highlight whether IT is moving the organization in the right direction.

21 Key IT Performance Metrics to Monitor

Tracking the right IT metrics is essential for IT leaders to evaluate performance, ensure efficient
operations, and align IT strategies with business objectives. Here are 21 critical metrics to
monitor:

1. System Availability and Uptime

The percentage of time systems are operational and accessible to users. High availability ensures
consistent service delivery, minimizes disruptions, and supports business continuity.

2. Response Time

Measures the time taken to acknowledge IT issues after they are reported. Quick
acknowledgment reflects a proactive IT team ready to address potential disruptions.

3. Resolution Time

Tracks the time taken to resolve reported IT issues. Faster resolutions ensure timely service
restoration and reduce downtime.

4. User Satisfaction and Experience

Uses feedback and satisfaction scores to gauge the end-user experience with IT services. Positive
scores indicate effective IT support and systems.

5. Error Rates

Monitors the frequency of system errors, categorized by severity, to identify recurring technical
issues and improve reliability.

6. Incident Rates

The total number of IT incidents logged over a specific period. This metric offers insights into
system reliability and areas needing improvement.

7. Capacity Utilization

Tracks the percentage of IT resources like storage, servers, and CPUs being used. Proper
monitoring prevents under- or over-utilization.

8. Bandwidth Utilization
Analyzes network bandwidth usage levels to detect bottlenecks and ensure smooth data transfer
and communication.

9. Cybersecurity Incident Frequency

Measures the number of security breaches or attempted intrusions, providing insight into the
effectiveness of security protocols.

10. IT Operational Costs

Tracks expenses across IT infrastructure, software, and staffing. Monitoring these costs helps
identify inefficiencies and allocate budgets effectively.

11. Technology Adoption Rates

Monitors the percentage of users adopting newly implemented tools. High adoption rates
indicate successful rollouts and user acceptance.

12. Database Query Performance

Evaluates the average response time for database queries, ensuring seamless access to critical
data.

13. Data Backup Success Rate

Tracks the percentage of scheduled backups completed successfully, safeguarding organizational

data against potential loss.

14. Downtime Costs

Calculates the monetary impact of system outages on business operations, emphasizing the
importance of uptime.

15. IT Support Ticket Volume

Monitors the total number of support tickets received by the help desk. This metric reflects
demand for IT support.

16. First-Call Resolution Rate

Measures the percentage of tickets resolved during the first interaction, indicating the efficiency
of IT support processes.
17. Patch Management Metrics

Tracks the frequency and success rate of software patches applied to systems, ensuring security
and optimal performance.

18. Compliance Metrics

Monitors the percentage of IT operations adhering to regulatory and internal compliance

standards, reducing risks.

19. Application Performance Metrics

Evaluates the performance of applications, including load times and error rates, to provide
smooth user experiences.

20. Energy Efficiency in IT Infrastructure

Tracks the energy consumption of IT systems, supporting sustainability and cost-saving

initiatives.

21. Employee Productivity Impact

Assesses the correlation between IT system performance and employee productivity, showcasing
IT's role in organizational success.

Monitoring these metrics equips IT leaders with the insights needed to optimize systems, support
strategic goals, and ensure efficient operations.

Best Practices for IT Metrics Implementation

Implementing IT metrics effectively requires a structured approach to ensure they provide

actionable insights and align with organizational goals. Below are key practices to help IT
leaders maximize the value of their metrics.

 Establishing Clear Measurement Criteria

One of the first steps in implementing IT metrics is to define benchmarks and targets for key
performance indicators. Clear criteria help establish what success looks like, enabling teams to
measure progress effectively.

For example, a benchmark for system uptime might be 99.9%, while response times for IT issues
could be targeted at under 15 minutes. These benchmarks set the standard for performance and
ensure teams have clear goals to work toward. Without defined criteria, metrics lose their ability
to drive meaningful improvements.

 Regularly Reviewing and Updating Metrics

IT goals and challenges evolve over time, making it essential to review and update metrics
regularly. Outdated metrics may no longer align with organizational priorities or reflect the
current IT environment.

For instance, a company transitioning to cloud infrastructure may need to replace on-premises
metrics with those focusing on cloud performance and adoption rates. Regular reviews ensure
metrics stay relevant, adaptable, and aligned with strategic objectives, preventing wasted efforts
on tracking irrelevant data.

 Communicating Metrics to Stakeholders

Transparent communication of metrics across teams and stakeholders fosters alignment and
accountability. Use clear, visual reporting tools like dashboards or periodic reports to present
data in an easily digestible format.

For example, sharing metrics on service desk performance, such as resolution times and
customer satisfaction scores, keeps both IT teams and leadership informed. Transparent
communication builds trust, facilitates collaboration, and ensures everyone works toward
common goals.

 Utilizing Metrics for Continuous Improvement

Metrics are most valuable when used to drive actionable changes. For example, if capacity
utilization metrics reveal underused servers, IT teams can reallocate resources or adjust
configurations to improve efficiency.

Similarly, recurring incident rates can trigger targeted training or system upgrades. By turning
data insights into specific actions, organizations can foster a culture of continuous improvement,
ensuring long-term success.

IT PROJECT MANAGEMENT METRICS

What Are IT Project Management Metrics?

IT Project management metrics are quantifiable measures to evaluate and monitor a project’s
performance, progress, and success. These metrics provide objective data on schedule adherence,
budget control, quality standards, resource utilization, and risk management. By tracking these
metrics, project managers can identify potential issues, make informed decisions, and ensure the
project aligns with its goals. Common metrics include on-time task completion, budget variance,
defect rates, and resource efficiency, all of which help improve project predictability and overall
outcomes.

Significance of IT Project Management Metrics in Evaluating IT Project Success

Project management metrics are essential tools for assessing a project’s progress, performance,
and overall success. These metrics provide quantifiable data that enable project managers to
make informed decisions, address potential issues proactively, and align project outcomes with
organizational goals. Here’s why they are crucial:

 Tracking Progress and Performance: Metrics help monitor a project’s adherence to its
timeline, budget, and scope. Key performance indicators (KPIs) such as schedule
variance (SV) and cost variance (CV) enable managers to assess whether the project is on
track or requires adjustments.
 Improving Decision-Making: By providing objective insights, metrics empower project
managers to identify bottlenecks and prioritize resources effectively. For example,
metrics related to resource utilization can highlight inefficiencies, allowing teams to
reallocate efforts for maximum productivity.
 Ensuring Stakeholder Alignment: Metrics facilitate transparent communication with
stakeholders by offering measurable proof of project status. Metrics like earned value
(EV) and customer satisfaction scores help demonstrate progress toward goals and build
stakeholder confidence.
 Mitigating Risks: Early identification of deviations from planned metrics enables
proactive risk mitigation. For example, tracking risk occurrence rates and issue resolution
times helps prevent minor setbacks from escalating into major problems.
 Enhancing Future Projects: Analyzing metrics from completed projects provides
valuable lessons for future endeavors. Metrics like actual vs. planned performance and
lessons learned can guide better planning and execution in subsequent projects.

Top 10 IT Project Management Metrics

IT Project Management Metrics are essential tools that help project managers measure, track,
and analyze the progress and success of an IT project. These metrics are crucial for making
informed decisions, ensuring the project stays on track, and achieving its objectives.

Here are some of the key project management metrics:

1. Project Schedule Variance (SV)

Project Schedule Variance is a key metric for determining if a project is progressing according to
its planned schedule. It compares the Earned Value (EV) (the value of work completed) to the
Planned Value (PV) (the value of work that was planned to be completed by a specific time).

Formula: SV = EV – PV

A positive SV indicates that the project is ahead of schedule, whereas a negative value means it’s
behind schedule. By monitoring this metric, project managers can determine if corrective actions
are needed to stay on track.

2. Cost Performance Index (CPI)

The Cost Performance Index measures the cost efficiency of the work performed. It compares
the Earned Value (EV) of the project (the value of work completed) with the actual Cost of Work
Performed (ACWP).

Formula: CPI = EV / ACWP

A CPI greater than 1 indicates the project is under budget, meaning the cost efficiency is higher
than expected. A value less than 1 signals that the project is over budget, requiring careful
analysis and corrective action.

Monitoring CPI helps ensure the project stays within financial constraints and helps identify
areas where costs may rise.

3. Earned Value (EV)

Earned Value (EV) quantifies the value of the work completed up to a given point. It provides
insight into project performance and is a critical indicator of whether the project meets its
objectives on time and within budget.

Formula: EV = Percent of Work Completed × Total Project Budget

EV helps track both time and cost performance and serves as the basis for other important
metrics like Schedule Variance (SV) and Cost Performance Index (CPI).

4. Return on Investment (ROI)

Return on Investment (ROI) evaluates the financial value generated by a project relative to its
cost. It’s a fundamental metric for assessing whether the project provides sufficient financial
return to justify the investment.
 Formula: ROI = (Benefits – Costs) / Costs

A higher ROI indicates that the project is delivering good value, while a negative ROI suggests
that the project might not be worth pursuing. This metric helps justify the project’s initiation and
can be used to demonstrate its success once it is completed.

5. Project Quality Metrics

Quality is crucial for project success, and Project Quality Metrics help ensure that the project
meets the desired standards and objectives. These metrics often include:

 Defect Rates: The number of defects or issues found in the project’s deliverables
 Rework Percentage: The proportion of work that needs to be redone due to quality issues
 Customer Satisfaction: Feedback from stakeholders or customers regarding the quality of
the deliverables

Tracking these metrics ensures that the project not only meets the required specifications but also
delivers a final product that satisfies stakeholders and customers.

6. Scope Creep

Scope Creep refers to the uncontrolled changes or additions to a project’s scope after the project
has started. It can cause delays, cost overruns, and resource strains if not managed effectively.
This metric tracks the extent to which the scope has been expanded beyond the initial plan,
helping project managers identify whether unauthorized changes are being introduced

Formula: Scope Creep = (New Work Added) / (Original Project Scope)

By monitoring scope creep, project managers can implement better change control processes and
prevent the project from drifting away from its original goals.

7. Team Performance Metrics

Team Performance Metrics help assess the productivity and efficiency of the project team. It’s
important to measure team members’ output and overall effectiveness to ensure project success.

 Task Completion Rate: The percentage of tasks completed on time

 Time Spent on Tasks: The amount of time spent on each project task relative to the
estimated time
 Employee Engagement: Surveys or feedback mechanisms to gauge team members’
motivation and commitment level
High team performance is often linked to better project outcomes, so it’s crucial to track these
metrics to identify potential resource issues or areas for improvement.

8. Risk Metrics

Risk Metrics assess how well potential risks are managed and whether their impact has been
mitigated. It’s essential to continuously track risks throughout the project lifecycle to avoid
costly surprises. Some key risk metrics include:

 Risk Impact: The severity of risks encountered and how they affect project objectives
 Risk Possibility: The probability of risks occurring
 Risk Exposure: A combination of the likelihood and impact, providing a sense of the total
exposure to risks

By closely tracking risk metrics, project managers can take proactive measures to reduce risk
exposure and enhance project stability.

9. Stakeholder Satisfaction

Stakeholder Satisfaction is a critical metric that reflects how well the project is meeting the
expectations of its stakeholders. Keeping stakeholders satisfied helps ensure continued support
and avoids conflicts that can risk project success.

 Surveys and Feedback: Regular surveys and feedback collection can gauge stakeholder
sentiment
 Frequency of Stakeholder Engagement: Monitoring how often stakeholders are involved
and their level of engagement with the project

Stakeholder satisfaction is particularly important for long-term projects or those that require
external buy-in and support for successful completion.

10. Resource Utilization

Resource Utilization measures how efficiently resources (e.g., people, equipment, materials) are
being used in the project. It ensures that resources are allocated effectively to avoid bottlenecks
and ensure optimal productivity.

Formula: Resource Utilization = (Total Work Done) / (Available Resources)

By tracking this metric, project managers can ensure that resources are neither underutilized
(leading to inefficiency) nor overburdened (leading to burnout and project delays)
Effective resource utilization allows the project to maintain a balance between cost and schedule,
contributing to the project’s overall success.

IT GOVERNANCE AND SECURITY METRICS

IT Governance and Metrics

The IT governance mechanism ensures that stakeholder needs, conditions and options are
evaluated to determine balanced, agreed-on enterprise objectives. IT governance also ensures
that direction is set through prioritization and decision making and that performance and
compliance are monitored against agreed-on direction and objectives. Management plans, builds,
runs and monitors activities in alignment with the direction that is set by the governance body to
achieve the enterprise objectives.

The IT governance processes are to evaluate, direct and monitor (EDM). Metrics are a
monitoring mechanism and help management monitor the achievements of the enterprise’s
business-related goals and IT-related goals. Appropriate metrics help the governing body provide
direction that is based on defined goals and an evaluation of metrics. Metrics help enterprises
answer valuable questions, such as:
  Is IT performance better than last year?
 What is the enterprise getting from IT investments?
 How can the enterprise benchmark performance?
 What should the enterprise do in the absence of measureable metrics? Can it use risk
management, loss expectancy, attack vectors or correlation?

Metrics describe a quality and require a measurement baseline, e.g., 87 percent of incidents
reported were resolved within two hours. These measurements demonstrate workloads and
activity. Metrics are useful for evaluating compliance and process effectiveness and measuring
success against established objectives. Enterprises expect positive outcomes from IT and IT
resources, including skilled human resources. To manage the performance of IT, management is
interested in getting the answers to the questions in the first column in figure 1. The second
column shows the type of indicators that are required to get the answers to these questions.

Types of Indicators and Metrics

The need for metrics and indicators is underlined by many organizations, such as the Information
Technology Infrastructure Library (ITIL), ISACA (COBIT 5) and ISO. Although ISO expects a
measurement of performance, it does not prescribe any specific indicators. Measurement
methods may be defined by organizations.

ITIL defines three types of metrics: technology metrics, process metrics and service metrics.
Note that technology and process metrics are also referred to as operational metrics.

Technology Metrics

Technology metrics measure specific aspects of the IT infrastructure and equipment, e.g., central
processing unit (CPU) utilization of servers, storage space utilized, network status (e.g., speed,
bandwidth utilization) and average uptime (availability of technology).
Most technology metrics provide inputs on IT utilization, which is a very small part of service, to
the chief information officer (CIO) or data center manager; however, unless this metric is
compared with another metric, it may not provide meaningful information for top management.
For example, consider a network response of 100 milliseconds, (i.e., a message reaches its
destination in 100 milliseconds). If management expects network response to be 10 milliseconds,
the response time requires attention, and if management expects network response to be 300
milliseconds, the response time is more than satisfactory.

Process Metrics

Process metrics measure specific aspects of a process, e.g., number of changes that are rolled
back within a month, average incident response time in a month, percentage of employees who
attended to task on time, average time to complete a process.

Process metrics provide information about the functioning of processes. These metrics are
generally used for compliance conformance that is related to internal controls. However, too
many process metrics may not serve the purpose of monitoring. Metrics that are related to critical
processes may be considered for management reporting.

Service Metrics

The primary focus of ITIL is on providing service. Service metrics are essential metrics for
management to monitor. They provide an end-to-end measurement of service performance.
Defining service metrics can be difficult due to the intangible nature of service levels. Service
metrics are more like assessments about what is already known about a problem and are
measured in a way that provides ballpark results. When it is difficult to measure the service
levels due to associated uncertainty (e.g., unpredictable human behavior) such uncertainty in
measuring service levels can be reduced at indicative levels and can be brought within ballpark
measurements.

Examples of service-level metrics include the following:

 Results of a customer satisfaction survey indicating how much IT contributes to customer

satisfaction
 Cost of executing a transaction (banks use this metric to measure the cost of a transaction
that is carried out via different service channels, such as Internet, mobile, ATM and
branch)
 Efficiency of service, which is based on the average time to complete a specific service.
A service is not just a process; a service can consist of multiple processes.
Many types of metrics are required for a comprehensive understanding of the health of service
management throughout the enterprise.

COBIT 5

COBIT 5 is primarily an IT governance framework. Effective governance management must be

able to manage risk and meet stakeholder expectations by optimizing resources. COBIT 5
identifies the following seven enablers that help to achieve governance objectives:

 Principals, policies and frameworks

 Processes
 Organizational structures
 Culture, ethics and behavior
 Information (data)
 Services, infrastructure and applications
 People, skills and competencies

Stakeholder expectations help management to arrive at a method for benefits realization, which
helps to determine enterprise goals. Because enterprises deploy IT, these goals cascade into IT-
related goals, which cascade into enabler goals (see figure 2).
To monitor goal achievement, management uses indicators and metrics. COBIT 5 identifies two
types of indicators:

 Lead indicators are activities that predict the achievement of goals. These indicators are
not measurable, e.g., implementing global or industry best practices or following the life-
cycle approach for resources (enablers).
 Lag indicators are measurable and help measure the achievement of goals. Most metrics
are defined for lag indicators.

COBIT 5 identifies three levels of metrics: enterprise goal metrics, IT goal metrics and process
goal metrics.

Enterprise Goals and Sample Metrics

COBIT 5 identifies 17 generic enterprise goals that are based on dimensions of a balanced
scorecard (BSC). These dimensions are financial, customer, internal, and learning and growth.

Generic metrics for IT goals and process goals are defined in the process description for each
COBIT 5 process. The COBIT 5 process reference model identifies 37 IT-related generic
processes. Metrics can be defined using COBIT 5. Consider the enterprise goal of customer-
oriented service culture. COBIT 5 suggests using the following metrics:

 Number of customer service disruptions due to IT service-related incidents (reliability)

 Percent of business stakeholders satisfied that customer service delivery meets agreed-on
levels
 Number of customer complaints
 Trend of customer satisfaction survey results

Depending upon the organization’s customer services offered using IT solutions, the following
metrics (which shall be a subset of metrics defined previously) may be considered:

 Impact on customer satisfaction due to service disruptions because of IT-related incidents

 Percent of business stakeholders satisfied that customer service delivery meets agreed-on
levels
 Reduction or increase in number of customer complaints related to non-availability of IT-
based services

There are two IT-related goals that primarily map to the enterprise goal of customer-oriented
service culture. They are IT-related goals 01, Alignment of IT and Business strategy and 07,
Delivery of IT services in line with business requirements. Metrics suggested for IT-related goal
07 from COBIT 5 are (for simplicity, only those IT goals that primarily map to the enterprise
goal in the example have been considered):
  Number of business disruptions due to IT service incidents
 Percent of business stakeholders satisfied that IT service delivery meets agreed-on
service levels
 Percent of users satisfied with the quality of IT service delivery

Based on business requirements, the following metrics may be considered:

 Number of IT incidents affecting business service

 Percent of IT incidents affecting business service to total IT incidents
 Number of customer complaints related to service delivery due to issues related to IT

20 Cybersecurity metrics and KPIs to track

Below are some examples of clear cybersecurity metrics and KPIs you can easily track
and present to your business stakeholders.

1. Level of preparedness

Assessing the level of preparedness against cyberattacks is a key metric. It evaluates the
readiness of your organization to handle and mitigate cybersecurity threats.

Device and software updates: Track the percentage of devices and software that are fully
patched and up-to-date. Regular updates are a fundamental part of maintaining a strong defense
against emerging threats.

High-risk vulnerability identification: Count the number of high-risk vulnerabilities identified

within your system. This metric helps in prioritizing which vulnerabilities to address first,
ensuring efficient allocation of resources towards mitigating the most critical risks.

2. Unidentified devices on the internal network

The presence of unidentified devices, such as employee personal devices or

unrecognized Internet of Things (IoT) devices, poses a significant risk. These devices often lack
proper security measures and can become entry points for cyberattacks.
Device count: Quantify the number of unidentified devices connected to your network. This
helps in understanding the scale of potential risk exposure.

Device inventory log: Establish if your organization maintains a comprehensive log of all
devices connected to the network. A detailed inventory aids in tracking and managing network
access, ensuring better control over network security.

Security protocol for new devices: Evaluate if there are protocols in place for new device
detection and security assessment. Proactive measures for new devices can significantly mitigate
risks associated with unauthorized or vulnerable devices on your network.

3. Intrusion attempts

Monitoring and quantifying intrusion attempts is essential for understanding the intensity and
frequency of cyber threats your organization faces. Regularly tracking these attempts helps in
evaluating the resilience of your cybersecurity measures.

Breach attempts count: Document the number of times attackers have attempted to breach your
networks. This metric provides insight into the level of interest from cybercriminals.

Source identification: Identify the common sources or methods of these intrusion attempts. This
information is crucial for reinforcing your cybersecurity defenses against the most prevalent
attack vectors targeting your organization.

4. Data Loss Prevention Effectiveness

Evaluating the performance of Data Loss Prevention (DLP) systems is crucial in measuring their
efficiency in protecting sensitive information. This metric gauge the system’s ability to
effectively prevent unauthorized data access or leaks.

Incident prevention ratio: Calculate the ratio of successfully thwarted data incidents to the total
number of attempts. This ratio offers a quantifiable measure of your DLP system’s effectiveness.

Response time: Assess the response time of the DLP system to potential data breaches. A
quicker response time can significantly reduce the risk and impact of data leaks.

False positives and negatives: Monitor the rate of false positives and negatives. A high rate of
false alerts can indicate over-sensitivity, while missed incidents point to gaps in the system.
Balancing accuracy with responsiveness is key to an effective DLP strategy.

5. Mean Time Between Failures (MTBF)

MTBF is an essential metric for assessing the reliability and durability of your cybersecurity
systems. It calculates the average time interval between two successive system or component
failures.

Reliability assessment: MTBF provides a benchmark for evaluating the reliability of your
cybersecurity infrastructure. A longer MTBF indicates more robust and reliable systems.

Predictive maintenance: By tracking MTBF, organizations can predict potential system failures
and schedule maintenance proactively, minimizing downtime and disruptions.

Performance trends analysis: Analyzing trends in MTBF over time helps in identifying
patterns and areas of improvement. If MTBF shortens over time, it might indicate aging
infrastructure or increased external threats, signaling a need for upgrades or enhanced security
measures.

6. Mean Time to Detect (MTTD)

MTTD is a key metric that quantifies the average duration it takes for your cybersecurity team to
detect a potential security incident. It’s crucial in assessing the responsiveness and vigilance of
your security operations.

Detection efficiency: MTTD helps gauge how efficiently and swiftly your cybersecurity systems
and team can identify threats. A shorter MTTD implies quicker detection, allowing for faster
response to mitigate risks.

Improving response strategies: By analyzing MTTD, you can identify areas for improvement
in your threat detection methodologies. This could lead to enhancements in your security
monitoring tools, alert systems, or team training.

7. Mean Time to Acknowledge (MTTA)

MTTA plays a critical role in assessing the efficiency of an organization’s response to

cybersecurity incidents. It measures the average duration between the initial detection of an
incident and when it’s formally acknowledged or logged by your team.

Response readiness: MTTA is indicative of your team’s readiness and ability to start addressing
cybersecurity issues. A lower MTTA suggests a prompt recognition and initial handling of
potential threats, which is vital for effective incident management.

Documentation and protocol compliance: Documenting MTTA and ensuring adherence to set
protocols is crucial. It not only standardizes the response process but also provides valuable data
for analyzing your security team’s performance.
Improvement of response procedures: Regularly reviewing MTTA statistics can help identify
trends or delays in incident acknowledgment. This insight is invaluable for refining alert
systems, optimizing communication channels, or enhancing staff training to improve overall
response times.

8. Mean Time to Contain (MTTC)

MTTC is a crucial metric in cybersecurity, indicating the efficiency with which your team can
control or limit the impact of a security breach or threat once it’s been detected, including how
long it takes to contain identified attack vectors.

Containment efficiency: The MTTC measurement reflects how swiftly your security team can
isolate and mitigate a threat, minimizing its potential damage. A lower MTTC is indicative of
effective containment strategies and robust incident response protocols.

Process evaluation and optimization: Analyzing the MTTC helps in evaluating the
effectiveness of your incident containment procedures. It provides insights into areas needing
improvement, such as the need for more efficient tools or enhanced staff training.

Consistency in containment practices: Ensuring that the steps taken to contain threats are well-
documented and consistently executed is vital. This uniform approach to incident containment
not only streamlines responses but also enables a more systematic analysis of security protocols.

Scenario planning and preparedness: Regularly reviewing and practicing containment

scenarios based on past MTTC data can improve your team’s preparedness for future incidents.
It fosters a proactive security culture, enhancing the organization’s overall resilience against
cyber threats.

9. Mean Time to Resolve (MTTR)

MTTR—or Mean Time to Resolve/Recover—is a vital metric in cybersecurity used to measure

how quickly an organization can detect, respond to, and fully recover from a security incident.
While often used interchangeably, MTTR encompasses two key phases: resolution (removing the
threat) and recovery (returning to normal operations).

Resolution efficiency: This metric gauge the effectiveness and speed of your cybersecurity team
in resolving and recovering from threats. A shorter MTTR signifies a more efficient response
and recovery process, crucial in minimizing the impact of cyber incidents.

Recovery process and protocols: Understanding the MTTR helps in assessing the robustness of
your recovery protocols. It provides insights into how well-equipped your team is in restoring
normal operations after a breach, including data recovery and system repairs.
Historical analysis: Analyzing historical MTTR data can reveal trends and improvement areas
in your organization’s recovery processes. This analysis enables leadership to improve
workflows, reallocate resources, or invest in automation tools that drive down response and
recovery times.

Documentation and consistency: Ensuring that the procedures for threat resolution are well-
documented and consistently followed is critical. A standardized approach aids in swift and
effective recovery, reducing the MTTR.

Preparedness and testing: Regularly testing your recovery procedures can help reduce the
MTTR. This includes conducting drills, reviewing recovery plans, and ensuring that all team
members are aware of their roles during a recovery process.

10. Days to patch (Vulnerability Patching Rate)

One of the fundamental cybersecurity metrics is the Vulnerability Patching Rate, or days to
patch, which measures how quickly an organization addresses identified vulnerabilities. It
gauges the efficiency of patch management systems and processes in place. A high patching rate
indicates a proactive approach to addressing vulnerabilities, minimizing the exposure window
and reducing the potential attack surface.

To calculate this metric, divide the number of patched vulnerabilities by the total number of
identified vulnerabilities within a specific timeframe, typically monthly. A higher percentage
suggests a robust patch management strategy and a lower risk of successful cyberattacks
exploiting known vulnerabilities.

Cybercriminals often exploit lags between patch releases and implementation. Measuring this is
a good way to understand the efficiency of your team post cyber breach.

 How long does it take your team to implement security patches?

 How is the “days to patch” cybersecurity metric defined and measured within your
organization?

11. Cybersecurity awareness training

This metric evaluates the effectiveness of educational programs and activities aimed at
enhancing employees’ knowledge and practices regarding cyber threats and prevention.

Training coverage and inclusivity: It’s vital to ensure that cybersecurity training encompasses
all levels of the organization, from entry-level employees to top management. Including senior
executives in these programs reinforces the importance of cybersecurity across the organizational
hierarchy.
Documentation and compliance: Maintaining comprehensive documentation of training
sessions, attendance, and content helps in tracking compliance and identifying areas needing
additional focus. This documentation serves as proof of proactive cybersecurity measures, which
is crucial during audits or post-incident analyses.

Effectiveness and engagement: Assessing the effectiveness of these training programs through
feedback and tests helps in understanding how well the information is being absorbed. Engaging
and relevant training material is more likely to resonate with employees and lead to better
cybersecurity practices.

Regular updates and relevance: Cybersecurity threats evolve rapidly, so training content
should be regularly updated to reflect the latest threats and best practices. This ensures that the
training remains relevant and effective.

Cultural integration: Integrating cybersecurity awareness into the organizational culture can
significantly improve the overall security posture. Creating a culture where cybersecurity is a
shared responsibility encourages vigilance and proactive behaviors among all staff members.

Metrics and KPIs: Establishing key performance indicators (KPIs) for cybersecurity training,
such as engagement rates, knowledge improvement, and behavior change, can provide valuable
insights into the training program’s impact and areas needing improvement.

 Who has taken (and completed) training? Did they understand the material?
 Does your organization offer recurring employee cybersecurity training?
 Are employees tested on the material they learn from their cybersecurity awareness
training?

12. Number of cybersecurity incidents reported

Reporting incidents demonstrates that your employees and other stakeholders recognize issues
within your network and act to try and resolve these issues. It also means your training is
working.

 Are users reporting cybersecurity issues to your team? How does the number of reported
cybersecurity incidents compare to industry benchmarks or previous years?

13. Security ratings

Often the easiest way to communicate metrics to non-technical colleagues is through an easy-to-
understand score. Security Scorecard’s security ratings give your company an A-F letter grade on
10 security categories (network security, DNS health, patching cadence, cubit score, endpoint
security, IP reputation, web application security, hacker chatter, leaked credentials, and social
engineering). Based on these 10 factors, you’re then assigned an overall grade, so you and your
colleagues can see at a glance how secure your company is relative to the rest of your industry.

 What is the security rating of your organization?

 How does your security rating compare against competitors?

14. Access management (and User Authentication Success Rate)

Access management as a cybersecurity metric relates to the controls, practices, and processes
created and implemented by an organization to manage the control of user access to systems and
networks.

 How many users have administrative access?

 How is user access managed within the organization’s systems and networks?

Privileged Access Review Rate tracks how frequently your organization audits high-level user
accounts—like admins, system engineers, and service accounts—to ensure their access is still
necessary and secure. Unchecked or outdated privileges can turn into open doors for attackers.
Regular reviews help eliminate unnecessary high-risk access and reduce the blast radius if
something goes wrong.

 Are privileged accounts being reviewed on a regular schedule, or have some slipped
through the cracks?
 Do you know how many elevated accounts exist in your environment—and why they
have access in the first place?

User Authentication Success Rate evaluates the efficiency and effectiveness of authentication
mechanisms in place, such as passwords, multi-factor authentication (MFA), or biometrics. It
measures the percentage of successful user authentications compared to the total attempts.

A high authentication success rate indicates robust access controls and authentication
mechanisms, reducing the risk of unauthorized access. Monitoring this metric helps
organizations identify potential weaknesses in authentication systems, enabling timely
enhancements and strengthening security measures.

15. Security Policy compliance

Security policy compliance refers to the organization’s ability to align security practices,
procedures, and controls with established security policies and standards. Adhering to
compliance requirements is a fundamental aspect of cybersecurity, as regulatory standards often
dictate essential security measures. Monitoring compliance adherence assesses how well an
organization aligns with relevant industry-specific or legal cybersecurity standards, such
as GDPR, HIPAA, or PCI-DSS.

 How well are you tracking and documenting exceptions, configurations,

and compliance controls?
 Is there a process in place to track and monitor employee compliance with security
policies?

16. Non-human traffic (NHT)

Ensuring that your business is not tracking bot traffic as a metric is key to understanding the
success of business operations and efforts. Non-human traffic is a cybersecurity metric that refers
to the portion of network or web traffic that originates from automated sources rather than
human users.

 Are you seeing a normal amount of traffic on your website or is there an uptick that
indicates a potential bot attack?
 What percentage of your overall web traffic is categorized as non-human?

17. Virus infection monitoring

Continuously monitoring virus infections is a cybersecurity KPI that refers to ongoing

surveillance of applications, systems, and endpoints to monitor for the presence of
viruses, malware, or malicious code.

 How often does your antivirus software scan common applications such as email clients,
web browsers, and instant messaging software for known malware?
 What actions are taken once a virus infection is identified?
 How is it contained and remediated?

18. Phishing attack success

Phishing attack success refers to the success rate of cybercriminals or threat actors achieving
their malicious objectives in deceiving users via phishing attempts.

 What is the percentage of phishing emails opened by end-users?

 Are there any specific types or variations of phishing attacks that have been successful?

On a broader level, Phishing Click Rate is also a crucial cybersecurity metric. This evaluates
how successful users are in identifying and avoiding phishing attempts. It is calculated by
measuring the percentage of users who clicked on phishing links in simulated or real-world
phishing campaigns.
A high click rate indicates a need for enhanced user training and awareness programs,
emphasizing the importance of recognizing and reporting phishing attempts. Regular training and
simulated phishing exercises can help organizations reduce the click rate, strengthening the
human element of cybersecurity defenses.

19. Cost per incident

Cost per incident in cybersecurity metrics refers to the amount of money and financial impact
associated with each security incident on an organization.

 How much does it cost to respond to and resolve an attack?

 How much money are you spending on staff overtime, investigation costs, employee
productivity loss, and communication with customers?

20. Security audit compliance

A security audit compliance will help your business to highlight areas where you may be lacking
in terms of effectiveness with the software you are currently using.

 What is the effectiveness of tools, technologies, and procedures your business is currently
using?
 What is the current process for updating existing softwares and programs?
BALANCE SCORECARD APPROACH TO IT PERFORMANCE MEASUREMENT

Introduction

The Balanced Scorecard (BSC), developed by Kaplan and Norton (1992), is a strategic
management framework that translates an organization’s vision and strategy into a coherent set
of performance measures across four perspectives: financial, customer, internal processes, and
learning & growth. When adapted to Information Technology (IT), the BSC enables
organizations to evaluate IT performance not only in financial terms but also in terms of its
strategic alignment, service quality, innovation, and contribution to business value (Van
Grembergen & Saull, 2001).

Concept of IT Balanced Scorecard (IT-BSC)

The IT Balanced Scorecard (IT-BSC) extends the traditional BSC framework to the IT function.
It provides a holistic performance measurement system that integrates IT operations with
business strategy and emphasizes value creation, efficiency, and continual improvement.

According to Van Grembergen (2000), the IT-BSC has a dual purpose: (1) to measure and
manage IT performance, and (2) to communicate IT’s value contribution to stakeholders
(executives, users, and IT staff).

Four Perspectives of IT Balanced Scorecard

Perspective Key Question Focus Areas Example Metrics /

KPIs
Corporate How do IT IT cost efficiency, ROI on IT
(Financial) investments ROI, budget investments; IT
contribute to utilization, IT- spend as % of
business value? enabled revenue revenue; Cost per
IT service
User (Customer) How do users view Service quality, User satisfaction
IT services? satisfaction, (CSAT); NPS; SLA
responsiveness, compliance;
trust Response time
Operational How efficient are Service delivery, MTTR; System
Excellence (Internal IT processes? incident uptime; Change
Process) management, success rate;
reliability, change Process automation
management ratio
Future Orientation How well is IT Staff capability, % of IT staff
 (Learning & positioned for innovation, certified; Training
Growth) future needs? training, knowledge hours; Innovation
management index
Implementation Framework

Implementation of an IT Balanced Scorecard typically involves: defining IT mission and

strategic objectives, identifying key performance areas, developing key performance indicators
(KPIs), setting measurable targets, and continuously monitoring performance through
dashboards and reviews.

Benefits of IT Balanced Scorecard

• Aligns IT initiatives with organizational strategy.

• Combines financial and non-financial performance measures.

• Communicates IT’s contribution to business stakeholders.

• Encourages learning and continuous improvement.

• Enables data-driven decision-making and accountability.

Example: IT-BSC for a Digital Payments Organization

Perspective Objective Example Metric

Financial Improve IT cost efficiency IT operating cost as % of
revenue
Customer Enhance reliability of Transaction success rate;
digital payment services User satisfaction score
Internal Process Improve system uptime Uptime ≥ 99.9%; MTTR ≤
and response 3 hours
Learning & Growth Build cybersecurity % of IT staff certified in
expertise security frameworks
Conclusion

The Balanced Scorecard approach provides a structured framework for measuring IT

performance beyond financial outcomes. It ensures that IT functions are aligned, efficient, user-
centric, and forward-looking, linking operational improvements to strategic value creation.