Imagine you’re the chief information security officer (CISO) of a big bank. You’ve just implemented a new cybersecurity program and you want to see how your metrics stack up against those of your peers. It should be easy, right? It’s not.
Unfortunately, there is no standardized process for measuring and reporting on cybersecurity metrics that all organizations can access. I can give my firsthand experience, or they can hire one of the big consultancies. Even then, the available data sets are too small and in different formats.
