Security Metrics Report Template (NIST SP 800-55, CSF 2.0)

Security Metrics Report: [Organisation name], [Reporting period]

Periodic report on the performance of an information security programme for executives, a board or a risk committee: headline status, measure catalogue, results and trends by NIST Cybersecurity Framework (CSF) 2.0 Function, risk context, incidents, initiatives, data quality, corrective actions and decisions requested. Based on NIST SP 800-55 Measurement Guide for Information Security, Volume 1 (identifying and selecting measures) and Volume 2 (developing a measurement program), both December 2024, and on NIST CSF 2.0 (February 2024). Replace every [bracketed] value and every row marked Example. Worked examples use Mirenza Insurance, a fictional insurer with about 3,100 staff, reporting for the quarter ending 30 September 2027. Regulatory references are dated examples, not legal advice: check the current official text and a qualified professional.

Document control

Approvals

Revision history

Contents

1. Executive summary
2. Purpose, audience and scope
3. Measurement approach
4. Measure catalogue
5. Results by CSF 2.0 Function
6. Trends
7. Risk context and appetite
8. Incidents and events in the period
9. Programme initiatives
10. Data quality, uncertainty and changes
11. Corrective actions
12. Decisions requested
13. Governance and regulatory context
14. Glossary and references
15. Standard and licence note

1. Executive summary

Overall status (Example): Amber, improving. Nine of the ten key measures met their targets or improved this quarter; only the cost of incidents worsened. Privileged accounts are now 98.8 % covered by phishing-resistant multi-factor authentication, and the median time to detect high-severity incidents fell from 9.5 to 7.2 hours. One measure is red: third-party security assessments (88.7 % of critical suppliers assessed against a 95 % target). One is amber: the share of critical and high vulnerabilities fixed within agreed timeframes (92.4 % against 95 %). One incident in the quarter met the internal "significant" threshold; it was contained within 16 hours and cost 546,000 of the quarter's 590,000 total incident cost.

Decisions requested (detail in section 12): approve funding for supplier assessment capacity (DEC-01) and accept a time-limited risk for the legacy claims platform (DEC-02).

2. Purpose, audience and scope

3. Measurement approach

3.1 Programme workflow

The measurement programme follows the five-activity workflow in NIST SP 800-55 Vol. 2, section 3: evaluate and define the existing security programme, identify and prioritise measures, collect and analyse data, identify corrective actions, and apply corrective actions. The cycle repeats each period, and the measure set itself is reviewed annually.

3.2 Measure types

Volume 1 notes that effectiveness and efficiency together are often called programme results. As implementation measures reach their targets, shift attention to the other three types.

3.3 Status rules

Direction compares this period with the previous one: Improving, Steady (change within the measure's tolerance) or Worsening.

4. Measure catalogue

4.1 Summary catalogue

4.2 Full definition (one example)

5. Results by CSF 2.0 Function

Underlying counts (Example):

MEA-05 is Amber, not Red, because it is inside the 90 % tolerance band and has improved for three consecutive periods with a dated plan (CA-02). MEA-02 is Red although improving, because 88.7 % is below the 90 % tolerance band.

6. Trends

Lines from bottom to top in Q3 2027: MEA-02 supplier assessments, MEA-05 vulnerabilities fixed in time, and the shared 95 % target. At the current pace (about 3 percentage points a quarter for MEA-05), MEA-05 reaches target in Q4 2027. MEA-02 needs 4 more assessments to reach 95 % (51 of 53, 96.2 %); with 2 to 4 assessments a quarter and the supplier list still growing, it is expected about Q2 2028 without the extra capacity in DEC-01, and in Q1 2028 with it (CA-01).

Bars show time to contain; the line shows time to detect. Medians from small numbers of incidents (4 to 9 per quarter) move a lot; read them with the counts in section 8.

7. Risk context and appetite

Incident cost (Example): 85,000 + 64,000 + 590,000 = 739,000 for Q1 to Q3 2027, plus 120,000 in Q4 2026, gives a rolling four-quarter total of 859,000, within the 1,000,000 appetite but close enough to watch. Compliance and audit readiness: the open supplier assessment gap is also an open internal audit finding (IA-2027-07), due for closure in Q1 2028.

8. Incidents and events in the period

INC-2027-031 (Example): an attacker used a compromised supplier support account to reach a document management server; detected in 6 hours by EDR, contained in 16 hours, no customer data exfiltration confirmed by forensic review. Cost 546,000: internal response 412,000, external forensics 96,000, precautionary customer notification and support 38,000. The other Q3 incidents cost 44,000 in total. Root cause: supplier remote access not covered by the controls applied to staff accounts. Full report: security/security-incident-report [INC-2027-031].

9. Programme initiatives

Security spending context (Example): security operating and project budget of 9.6 million is 3.08 % of the 312 million IT budget (9.6 / 312).

10. Data quality, uncertainty and changes

11. Corrective actions

12. Decisions requested

Record the committee's decisions in the minutes and in the next report's revision of this section. Risk acceptances go into the exception register (security/security-exception-request).

13. Governance and regulatory context

This report is internal. It does not by itself satisfy any disclosure or notification duty; check the current official texts and a qualified professional.

14. Glossary and references

14.1 Glossary

14.2 References

Standard and licence note

Based on NIST SP 800-55 Volume 1 and Volume 2 (December 2024) and the NIST Cybersecurity Framework 2.0 (February 2024), which are works of the US Government and not subject to copyright in the United States. Section numbers, measure type names, the measure documentation fields and the workflow activity names are cited from NIST SP 800-55; CSF 2.0 Function and category identifiers are cited as published. All other text, measures, targets and examples are original. Laws and codes are summarised in original words with article or provision numbers as dated examples for the EU, the UK and the US; check the current official text and a qualified professional. Check csrc.nist.gov for newer revisions. Template licence: MIT.