Uploaded via SlideShare as Apple Keynote
© All Rights Reserved
Settha Yok at Vattanac Bank
7 months ago
Berard olivier, Consultant en projet 2.0 / Social Business
1 year ago
hcchenu
1 year ago
Novak Dimitrovski, General Manager at Eurocert
1 year ago
David Chau at FPT
2 years ago
arj197
3 years ago
leeq
3 years ago
Avo Raup at itSMF Estonia
3 years ago
mkstar
3 years ago
Lonnell Branch, Business Intelligence Professional
4 years ago
Metrics, measures & Myths
We will also make a quick overview of what are CSFs, KGIs and KPIs and the intimate relationship between them.
As a security practitioner and consultant, I will give you some real examples of KPIs and how they integrate in a balanced scorecard and also talk about a real implementation of a security dashboard on a customer.
Finally, to wrap up, we will see the SMART side of metrics and a quick summary. Let’s go
The course in charted
Risks are identified, evaluated and managed
Resources and their criticality and sensitivity are determined
Objectives are:
Strategic alignment
Risk Management
Business process assurance
Value delivery
Resource Management
Performance measurement
It has to be pointed out that normalization of data it is very useful since you have to be able to compare between departments and divisions but also with other industry peers. Normalization places all the measures on a similar footing by equalizing them across a common organizational base
Besides, metrics are rarely raw data but some derivative number (ratio, index, percentage or weighted average)
Critical to successful implementation of metrics is the understanding and acceptance that they take an important commitment and use in time and resources
KGIs are a target to achieve, a measure of outcome
We are going to focus today in KPIs since they are the day-to-day metrics, the one being monitored constantly
In this context we need to remember that IT is a major enabler of the business and, therefore, KPIs are a measure of performance
As you can see in the graphic on the left, KGIs are just above generic IT goals and KPIs are next to IT processes showing their area or influence. Consequently, we could define KGIs as “lag” indicators while KPIs could be “lead” indicators. By the way, both measures could also be expressed negatively showing not having reached the goal or not performing well
KPIs have a cause-effect relationship with KGIs of the process
In summary, KGIs are business-driven while KPIs are process-oriented
Top-down approach
KPIs are quantifiable measurements, agreed to beforehand. However, I would like to deviate from the idea that there is a kind of negotiation with KGIs and KPIs. There should be an agreement but what really matters is the strategy and how a company is going to measure the achievement of the target. In the same way, scaling down to the IT or security department, there should be an agreement (again, not a biased negotiation) of what is needed and how security brings and adds value to the business (by preventing threats exploiting a vulnerability better than last month or year or some other measures that we are going to see in a moment).
The definition of BSCs given by Mr. Kaplan and Mr. Norton is very interesting. Listen for the words: comprehensive view, performance, management tool. A BSC is a method and a management tool for ensuring enterprise’s activities in terms of its vision and strategies by giving managers a fast, comprehensive view of the performance of a business. It is here where we should introduce the 4 different perspectives of a balanced scorecard: financial, customer, internal process and learning/innovation.
Scorecards - Most strategic level of the business decision while dashboard work more in the operational side giving key users metrics of their area of influence
Level 1 - Initial
Level 2 - Repeatable
Level 3 - Defined
Level 4 - Managed
Level 5 - Optimised
“Knowledge resides in the person, not in the data…it is the response and action to information that counts”
“You need to know what you have to be able to protect it”
(since KPIs are “lead” indicators)
FOCUS
MEASURABLE
ACHIEVEABLE
REALISTIC
TIME-DRIVEN