PM-6, Measures of Performance, is one sentence: develop, monitor and report on the results of information security and privacy measures of performance. It sits in the Program Management family, so it is organization wide. Federal programs are bound by it and contractors by agreement. For other teams it is a reference for the metrics you show a board or a customer.
What it means in practice
The record defines measures of performance as outcome based metrics for the effectiveness or efficiency of the security and privacy programs and their controls. It suggests aligning them with the organizational risk tolerance set in the risk management strategy (see PM-9 and PM-28).
Outcome is the key word. Counting scans run or trainings assigned measures activity. Median days to fix a critical vulnerability, or the share of employees who passed a phishing test, measures an outcome.
Three verbs sit in the statement: develop, monitor, report. A metric defined but never reported does not meet it.
Evidence to collect
- A metrics catalog with definitions, owners and data sources
- Dashboards or reports with dates
- Meeting notes where the results were reviewed
- Targets tied to stated risk tolerance
Common gaps
- Metrics count activity, not outcomes
- Numbers are pulled by hand and cannot be reproduced
- Results are reported but nobody acts on them
- Privacy has no measures at all
How to implement it
- Pick five to ten measures that map to your risk tolerance.
- Write each definition so someone else can recompute it.
- Automate collection where you can.
- Review results on a schedule and record decisions.
Quick check
What makes a measure of performance different from an activity count?
It is outcome based. It shows how effective or efficient the program is, not just how busy it is.
