Security dashboard: the cybersecurity KPIs worth tracking

A security dashboard brings together the indicators used to steer and report on information security. A good one does not show everything: it shows each audience what it needs to decide, from the technical team to the board.

This guide draws on the method published by ANSSI, France's national cybersecurity agency, and on the work of Clusif, a French information security association, to explain how to choose indicators, separate management from operational ones, document each cybersecurity KPI and present the whole to management.

ANSSI's platform describes the security dashboard as a summary and visualisation tool to track all security actions, check that the security policy is applied both at management level and in the field, and make sure useful information reaches decision-makers.

It meets three needs. Steering: knowing whether the objectives set by the security policy are being met. Alerting: spotting drift before it becomes an incident. Reporting: justifying resources and obtaining decisions. In an ISMS, it feeds the monitoring and measurement required by ISO 27001, which ISO/IEC 27004 details as guidance.

The TDBSSI guide was written by DCSSI, ANSSI's predecessor, in a version dated 5 February 2004. ANSSI still offers it and considers it relevant. It defines an indicator as data combining the measurement of one or more key points, compared with history, a target or a threshold. Its approach has five steps:

1. Prerequisites: identify recipients, define use and frequency, have security objectives, know the system and data sources, secure budget and resources.
2. Project set-up: involve the stakeholders and form working groups.
3. Design: formalise measurable objectives, choose what to measure, build indicators and dashboards, write data feeding procedures, get approval.
4. Operation: produce and distribute the dashboards.
5. Evolution: track their use and adapt them when context or objectives change.

The guide also sets qualities for each indicator: no duplication, proven usefulness against objectives, known causes of variation so you can act, and calculable at any time, simply and at reasonable cost. These criteria are often enough to remove half the indicators initially proposed.

ANSSI's method distinguishes three dashboard levels. The strategic level gives a summary view to steer security policy, with six indicators at most. The management level tracks objectives by domain, with about twelve indicators. The operational level measures basic components and often acts as an alarm, with up to about twenty indicators. Clusif's 2018 guide adds a temporary dashboard, set up for the duration of a crisis or major vulnerability.

What matters is the link between levels: each strategic indicator should be explained by management indicators, themselves calculated from operational measurements. Choose a strategic indicator to see the chain behind it.

There is no universal list: good indicators follow from your objectives and risks. Here is a starting point, inspired by Clusif's examples and ANSSI's method.

Risk indicators read best alongside the risk matrix and risk map behind them; compliance indicators presuppose clearly identified frameworks; third-party indicators rely on your vendor risk management programme. Indicators specific to compliance tracking are covered in our article on compliance management.

An undocumented indicator does not survive the departure of the person who calculates it. Clusif recommends keeping a sheet for each one that states:

• the label and the security objective it relates to;
• the calculation, unambiguously (numerator, denominator, scope);
• the data source and how it is collected;
• the update frequency;
• the target and alert thresholds;
• the indicator's owner.

In the United States, NIST published in December 2024 the two volumes of its Measurement Guide for Information Security (SP 800-55), covering how to select measures and set up a measurement programme: useful further reading.

The strategic level has gained weight with the NIS 2 Directive, whose Article 20 requires management bodies to approve cybersecurity risk management measures and oversee their implementation. Oversight requires something to oversee with. The ANSSI and AMRAE guide "Controlling the digital risk" devotes its final steps to how executives steer digital risk.

A few rules make the presentation effective:

• Few indicators, six at most, always the same from one meeting to the next so trends speak.
• A trend rather than an isolated figure: value, target and change since the last meeting.
• Business language: "three days of production downtime" rather than "critical vulnerability on a server".
• The decisions expected: a strategic dashboard ends with what you are asking management for (budget, risk acceptance, priority).
• A link to the enterprise risk map, kept by the risk manager, so cyber is compared with other risks on the same scales.

Clusif's guide also stresses an often-neglected point: whoever presents must be able to explain every figure and every change. That is usually the CISO.

• Measuring what is easy rather than what matters: the number of blocked emails says nothing about risk.
• Piling up indicators: beyond the reader's attention span, nobody reads any more.
• Figures without targets: 87% is neither good nor bad without an objective.
• Manual collection: each update takes days, figures arrive late and input errors pile up.
• A frozen dashboard: ANSSI's method includes an evolution step; an indicator that no longer triggers any action should go.

The hard part of a security dashboard is rarely choosing indicators: it is feeding them. Phinasoft starts from data your teams already produce in the platform, rather than re-keying it:

• indicators are calculated automatically from compliance assessments, risk analyses and action plans;
• indicators can be calculated by framework and by scope, at different levels of detail, and linked frameworks avoid assessing the same requirement twice;
• you build customised dashboards and generate summaries and exportable reports for management, business units and auditors;
• you keep an overall view of action plans, with each owner tracking their own.

These features are described on the compliance campaigns and risk analysis module pages. To see a dashboard built on your own scopes, you can request a demo.

Going further: the broader governance, risk and compliance approach explains how dashboards fit into the whole picture.