April 2019

Cybersecurity KPI Model【Outline】
 As business depends more and more on digital technology, the impact of cyber risks
increases. The greater the threats posed by the cyber world, the greater the difficulty
for a single organization to reduce the number of cyberattacks. However, potential
financial impacts from cyberattacks can be reduced through the efforts ofmanagement and staff.
 To reduce the potential financial impact and to promote digital innovation, JCIC hasdeveloped an original model, the Cybersecurity KPI Model (see Figure 1), throughinterviews and surveys. On the basis of this model, cybersecurity managers should
identify their KPIs in accordance with the maturity level of their organization in regards
to cybersecurity at the beginning of the fiscal year. This model will be updated on thebasis of feedback from companies of many different sizes and from multiple industries.
 Organizations ought to identify the purpose of cybersecurity for their organization
before setting up their KPIs. Management and cybersecurity managers should discuss
what their organizationʼs vision and strategy are, and what risks it would face. Thesediscussions will contribute to identifying their KPIs.
(Figure 1) Cybersecurity KPI ModelMaturity Level:
Optimizing

AdvancedMaturity Level:
Improving• Establish a prompt
incident info sharing
system and guidelines
within the industry

Externalcollaboration

Maturity Level:
Initial• Results of benchmarks andassessment• % of progress of supplieraudit• Results of assessment ofsubsidiaries• # of due diligence

Assessment• Create IR procedures• % of assets management• # of cybersecurity div. staff• % of IR procedure adoption• % of systems policy adoption• Mean time and FTEs tocontain cyber incidents /vulnerabilities

Organization/ Procedure• % of training attendance• # of APT email exercises• % of re-test attendance andre-test passes• # of CSIRT cyber exercises• # of cyber exercises formanagement

Training/Exercise• % of completion ofcompliance• % of resolution of issues
pointed out by an authority• Tokenization / Nonconservationof Personally Identifiable
Information－ComplianceStage of cybersecurity

ページ 1Basic

1.

Cybersecurity KPI Model Overview
JCIC has developed the Cybersecurity KPI Model by gathering 47 KPIs from interviews andother research and allocating them into three maturity levels.
The horizontal line in this model shows the cybersecurity maturity level, and the verticalline shows the category of activities with regard to cybersecurity such as external
collaboration, assessment, organization/process, training/exercises, and compliance.

 How to utilize the Cybersecurity KPI ModelOn the basis of this model, cybersecurity managers can identify KPIs according to theirmaturity level at the beginning of the fiscal year. It is not necessary to follow this model
strictly, but cybersecurity managers can customize these KPIs in accordance with theirorganizationʼs status.
(Figure 2) How to utilize the Cybersecurity KPI Model
Item
Target Audience

Description
CISO (Chief Information Security Officer) and manager ofcybersecurity division

When to utilize

At the beginning of the fiscal year

How to identify KPIs

First, select your organizationʼs cybersecurity maturity level on
the horizontal line. Next, identify your focus activities (KPIs)
from the vertical line and obtain approval from yourmanagement. Lastly, set up a detailed plan to achieve KPIs anddistribute them to your staff.

Benefits of KPI modelAbility to identify an organizationʼs KPIs according tomaturity levelA ability to evaluate performance objectively

Reduction of the potential financial impact

 Further steps
This model will be updated on the basis of feedback from companies of many different
sizes and of multiple industries. In addition, it seems to be necessary for JCIC to try toimplement further research, such as on the relationship between the Digital Transformation(DX) of an organization and its KPIs, on how to collect KPI related indicators automatically,
on how to deal with cybersecurity KPIs for their products, on how to measure the attitudes
toward security of an organization by using KPIs, and the like.
In our interviews, we found that some organizations use “KRIs (Key Risk Indicators)” tovisualize their cyber risks rather than KPIs. JCIC will introduce KRIs in the next report.

ページ 22.

Conclusion
This report illustrates JCICʼs original model, the Cybersecurity KPI Model, to reduce thepotential financial impact and to visualize cybersecurity. Using this model, cybersecurity
managers can identify their KPIs at the beginning of the fiscal year in accordance with theirmaturity level.
If it is difficult to choose which KPIs should be set up, JCIC recommends that management
and cybersecurity managers return to basics, such as asking, "What is the purpose of
cybersecurity at your company?". They should discuss what their organizationʼs vision andstrategy are, and what risks it will face. These discussions will contribute to identify theirKPIs.
Discussing cybersecurity goals with management, cybersecurity managers and related
divisions, and reporting performance to management on a regular basis, a cybersecurity
culture can be built within the organization. Such culture contributes to increasing budgetaryand human resources for cybersecurity.
To establish a secure and safe digital society, cybersecurity visualizing activities should beleveraged by not only single organizations or industries, but by all facets of business andsociety.

ページ 3

[Author]
Kenji Uesugi, JCIC Senior Fellow uesugi@j-cic.com
Toshihiro Hirayama, JCIC Senior Fellow hirayama@j-cic.com－ Legal Notice －

The JCIC does not take responsibility for the correctness, up-to-datedness, or quality of the information provided in any report.

The permission of the copyright owner must be obtained, in principle, provided that such permission is not required under certain
circumstances permitted by law. When reusing a JCIC report, please identify the source such as [Source: JCIC].

JCIC contact information : info@j-cic.com

ページ 4