Textbook in PDF format The Security Metrics Workbook walks you through a proven, step-by-step process for building a metrics program grounded in three principles: keep it simple, make it actionable, and build it to last. This is a practical guide you work through with a pen in hand, making real decisions about your own program as you go. Inside, you'll learn how to: Identify metrics that inform decisions, not just populate dashboards Distinguish between performance indicators, risk indicators, and control indicators Use the Value vs Effort Matrix to prioritize what's worth measuring Set meaningful targets that trigger action when crossed Document formulas and assumptions so metrics stay consistent over time Assign clear ownership so nothing falls through the cracks Translate security outcomes into language that leadership understands Each chapter includes discussion, examples, and worksheets designed to move you from concept to implementation. You'll review governance documents, interview stakeholders, assess data sources, and define metrics. By the time you finish, you'll have a complete game plan for what to measure, why it matters, and who's accountable. This workbook is for: Security leaders building a metrics program from scratch Teams refining an existing program that isn't delivering value Practitioners tired of reporting metrics that don't drive change Whether you're a CISO, GRC lead, security analyst, or risk manager, this workbook meets you where you are and gives you a clear path forward. No fluff. No buzzwords. Just a structured approach that works