Performance Measurement Guide for Information Security

Chew, Elizabeth; Swanson, Marianne; Stine, Kevin; Bartol, Nadya; Brown, Anthony; Robinson, Will

doi:https://doi.org/10.6028/NIST.SP.800-55r1

SP 800-55 Rev. 1

Performance Measurement Guide for Information Security

Documentation Topics

Date Published: July 2008

Supersedes: SP 800-55 (08/01/2003); SP 800-80 (05/04/2006)

Author(s)

Elizabeth Chew (NIST), Marianne Swanson (NIST), Kevin Stine (NIST), Nadya Bartol, Anthony Brown, Will Robinson

Abstract

This document provides guidance on how an organization, through the use of metrics, identifies the adequacy of in-place security controls, policies, and procedures. It provides an approach to help management decide where to invest in additional security protection resources or identify and evaluate nonproductive controls. It explains the metric development and implementation process and how it can also be used to adequately justify security control investments. The results of an effective metric program can provide useful data for directing the allocation of information security resources and should simplify the preparation of performance-related reports.

Keywords

Information Security; Metrics; Measures; Security Controls; Performance; Reports

Control Families

Assessment, Authorization and Monitoring; Maintenance; Planning; Program Management

Documentation

Publication:
SP 800-55 Rev. 1 (DOI)
Local Download

Supplemental Material:
None available

Related NIST Publications:
SP 800-55 Rev. 2 (Draft)
SP 800-55 Rev. 2 (Draft)

Document History:
07/16/08: SP 800-55 Rev. 1 (Final)

Topics

Security and Privacy
audit & accountability; maintenance; planning; risk management

Laws and Regulations
OMB Circular A-11