article thumbnail

Measure Security Performance, Not Policy Compliance

The Falcon's View

Except, of course, that in the real world nobody ever took time to read the more detailed documents, Ops and Dev teams really didn't like being told how to do their jobs, and, at the end of the day, I was frequently reminded that publishing a policy document didn't translate to implementation. Now, note a couple things here.

article thumbnail

Implementing and Maintaining Security Program Metrics

NopSec

Implementing information security policies and procedures that are enforced and backed by management are essential to the longevity and success of an effective information security program. Level 2: Quantify Performance Targets.