Cybersecurity Measurement Workshop 

Slack channel: You can join Slack using the invite 

link in your attendee email or by scanning the QR 

code. 

Submit a question: Type your question in the Q&A 

box in BlueJeans Events. 

Technical support: Send a message using 

the moderator chat. 

Inquiries: cyber-measures@list.nist.gov 

Agenda 

11:00 AM – 1:30 PM EDT (UTC-4) 

11:00 am 

11:10 am 

12:30 pm 

12:40 pm 

1:25 pm 

1:30 pm 

Welcome 

Panel Discussion with Q&A 

Break 

Overview of 800-55 with Q&A 

Wrap-up 

Adjourn 
Cybersecurity Measurement

Workshop 

December 13, 2022 
Welcome 

Charles Romine 

Director, Information Technology Lab 
Panelists 

Khalid Hasan Allison Krache 

Giddens Matthew Light 

Tom Siu Howard Whyte 
Thank you to our panelists 
 

 

 

 

 

 

 

Cybersecurity Measurement Workshop 

Slack channel: You can join Slack using the invite 

link in your attendee email or by scanning the QR 

code. 

Submit a question: Type your question in the Q&A 

box in BlueJeans Events. 

Technical support: Send a message using 

the moderator chat. 

Inquiries: cyber-measures@list.nist.gov 

Agenda 

11:00 AM – 1:30 PM EDT (UTC-4) 

11:00 am 

11:10 am 

12:30 pm 

12:40 pm 

1:25 pm 

1:30 pm 

Welcome 

Panel Discussion with Q&A 

Break 

Overview of 800-55 with Q&A 

Wrap-up 

Adjourn 
 

 

SP 800-55 Rev. 2 

Performance Measurement Guide 

for Information Security (initial

working draft) 
 

 

 

History of the Publication 

• SP 800-55, Security Metrics Guide for Information Technology 

• August 2003 

• SP 800-55 Rev. 1, Performance Guide for Information Security 

• July 2008 
 

 

 

 

Comment Submission 

SP 800-55 Rev. 2 (Draft)

Performance Measurement Guide for 

Information Security (initial working draft) 

More information at: 

https://csrc.nist.gov/publications/detail/sp/ 

800-55/rev-2/draft Comments Due: February 13, 

2023 Email Comments to: 

cyber-measures@list.nist.gov 
Note to Reviewers 
 

 

 

 

 

 

 

 

NIST SP 800-55 Rev. 2 

Fundamentals Development

Process 

Program

Implementation 

• Document Conventions 

• Benefits of Using 

Measures 

• Critical Success Factors 

• Types of Measures 

• Measurement 

Considerations 

• Program Scope 

• Stakeholders and 

interests 

• Goals and objectives 

• Policies, guidelines, and 

procedures 

• Program implementation 

• Level of implementation 

• Program results 

• Business/mission impact 

• Prepare for data collection 

• Collect and analyze results 

• Identify collective actions 

• Develop a business case 

• Obtain resources 

• Apply corrective actions 
 

 

Fundamentals 

Goal: Providing a common taxonomy 

Benefits of Critical Success Terminology Using Measures Factors 
 

 

Fundamentals 

Types of Measures 

Efficiency and Implementation Business Impact Effectiveness 

 

 

 

Fundamentals 

Measurement Considerations Program Scope 

• Organizational Considerations • Individual Information Systems 

• Manageability • Enterprise-wide Program 

• Data Management Concerns 

• Measurement Quality 

• Trends and Historical Information 

• Automation of Data Collection 
 

 

 

 

 

 

 

 

Fundamentals 

New Content Area: 

Measurement 

Quality 

•Clearly defined data 

gathering and reporting 

requirements 

• Standardizing the 

measurement process 

• Ensuring data quality and 

validity 

• Tracking changes over time 

to ensure consistency 

•Repeatability of processes 
 

 

 

 

 

 

 

Fundamentals 

New Content Area: 

Trends and 

Historical 

Information 

• Staying up to date on 

current rising threats 

• Including horizon 

scanning 

• Using the organization’s 

analytic results 

• Avoiding recency bias 
 

 

 

Fundamentals 

Measurement Considerations Program Scope 

• Organizational Considerations • Individual Information Systems 

• Manageability • Enterprise-wide Program 

• Data Management Concerns 

• Measurement Quality 

• Trends and Historical Information 

• Automation of Data Collection 
Measures Development Process 
 

Measures Development Process 

Stakeholder Goals and 

Identification Objectives 
 

 

 

 

Measures Development Process 

New Content Area: 

Governance and 

Compliance 

•Governance structures 

• Laws and regulations 

•Industry guidance 

•Various outside 

requirements 
 

 

Measures Development Process 

Policies, Guidelines, Measurement 

and Procedures Program 

Review Implementation 
 

Measures 

Development and 

Selection 

Level of 

Implementation 

Program Results 

Business/Mission 

Impact 

Measures Development Process 
 

 

 

 

 

Measures Development Process 

New Content Area: 

Measures 

Prioritization and 

Selection 

•Risk-based approach 

• Effective use of data 

•Measuring existing and 

established processes 
 

Measures Development Process 

New Content Area: 

Defining Evaluation 

Methods 

• Assessing against baselines 

and acceptable ranges 

• Component testing 

• Monitoring for anomalies 

• Success hitting control 

targets 

• Indicators 

• Frameworks 

• Maturity Modeling 

• Compliance 
 

Measures Development Process 

Measures Feedback within 

Development Development 

Template Process 
Measures Program Implementation 
 

Measures Program Implementation 

Phase 1: 

Prepare for Data Collection 
Measures Program Implementation 

Phase 2: 

Collect Data and Analyze Results 
 

Measures Development Process 

New Content Area: 

Data Collecting and 

Reporting 

• Automated data 

collection and reporting 

• Manual data collecting 

and reporting 
 

Measures Program Implementation 

Phase 3: 

Identify Corrective Actions 
Measures Program Implementation 

Phases 4 and 5: 

Develop and Business Case 

Obtain Resources 
 

Measures Program Implementation 

Phase 6: 

Apply Corrective Actions 
Next Steps 
Questions?
 

 

 

 

Comment Submission 

SP 800-55 Rev. 2 (Draft)

Performance Measurement Guide for 

Information Security (initial working draft) 

More information at: 

https://csrc.nist.gov/publications/detail/sp/ 

800-55/rev-2/draft Comments Due: February 13, 

2023 

Email Comments to: 

cyber-measures@list.nist.gov 
STAY IN TOUCH 

CONTACT US 

NIST.gov @nist