Skip to content

Latest commit

 

History

History
42 lines (27 loc) · 2.62 KB

Security_exceptions_metrics.md

File metadata and controls

42 lines (27 loc) · 2.62 KB

Security Exceptions Metrics

About

This document outlines good starting metrics to measure the effectiveness and operations of your security exceptions program.

# of open security exceptions

This metric outlines the total number of security exceptions to provide visibility into delays in remediation or risk treatment. It can highlight unsustainable backlog growth, a lack of prioritization in addressing risk, and shifts in risk tolerance.

# of security exceptions expiring

This metric indicates the amount of 'risk debt' requiring remediation from risk owners, typically within product, IT, operations, and engineering teams. This data point can be useful for senior tech leadership to understand each issue and prioritize reducing the debt.

# of expired security exceptions without risk treatment

This metric highlights risks that exceed previously agreed-upon resolution dates by risk owners and approvers. It is used to emphasize the lack of follow-up in addressing issues, delaying remediation, or prioritizing visibility for an issue. When presenting this metric, be prepared to discuss the current state of each issue, collaborate with risk owners to develop remediation plans, and escalate the issue as needed.

Additional Metrics

# of open security exceptions by status

This metric visualizes the overall state of all security exceptions, by their status. This is a useful data point for the program owner to understand the current outstanding items.

Example status'

  • Needs treatment Plan
  • Needs risk acceptance
  • Expiring
  • Expired

Average time to initial review

This metric measures the time between when an exception is filed and when it is reviewed. It helps identify operational slowdowns and assess whether reviews are completed within any internally defined SLAs.

Exceptions by severity level

This metric highlights the criticality of issues with security exceptions and provides insight into how frequently critical or high-risk issues are not prioritized for risk treatment.

Risk extension vs risk acceptance

This metric outlines which type of exception is most common and can be tracked on a month-to-month basis to show trends.

Security exceptions vs risks as a %

This metric can demonstrate the percentage of vulnerabilities or risks requiring a security exception from the total unresolved issues. It can be useful when combined with a maximum percentage target to ensure that risks are not simply "delayed" or "ignored" beyond a specific threshold. The target will depend on your company's risk tolerance and culture.

Metrics version 1.0 copied from Sectemplates.com 2024