# A Dynamic and Adaptive Cybersecurity Governance Framework
## 6 Performance Indicators of the Proposed Security Governance Framework  
To facilitate and maintain an effective and efficient governance of the security operations and process and to establish a successful and effective cybersecurity program across an organization, there is a need to come up with reliable key performance indicators (KPIs). Using KPIs, the security governance frameworks are implemented, monitored, measured, and evaluated [24]. Top management and Chief Information security officers (CISO) should measure the strategic, tactical, and operational efficiency of their security programs that are an integral part of the security governance system. These days, organizations are investing a lot of budget to secure the information system supporting the business operation. Top management should be convinced and aware of the importance of cybersecurity programs to allocate enough budgets on security related activities. To this end, senior managers responsible for an organization's security aspect need reliable KPIs to measure and evaluate the reliability of the security program. To measure, evaluate, and monitor the effectiveness of the security programs, policies, strategies, and countermeasures with in governance framework that is implemented in an enterprise, there is a need to develop security performance metrics that should be adapted according to the company's security governance strategies, processes and principles. In general, measuring the effectiveness of security controls means building a competency to fine-tune the security policy and programs, thereby deciding on the security investments. In view of the above facts, the implementation of the proposed cybersecurity governance framework can be well measured using the standard framework of metrics based on the governance framework structure such as process, technology, people, and compliance as shown in Figure 7.  
Figure 7: Security governance metrics. Some of the important metrics that can be used to measure the effectiveness of the security governance framework are presented below:  
Financial Metrics: It Is Mainly Deals with the Financial Impact of Security Controls Implemented to Safeguard and Create Resilience in Company Assets  
Financial metrics in cybersecurity mainly evaluate the security investment made to protect IT systems that support the company's business operation. ALE (Annualized loss expectancy), total cost of ownership (TCO), and economic value added (EVA) can be used as financial metrics. ALE is the annualized loss as a result of the cyber-risk impact. ALE can be calculated as part of cyber risk assessment as:  
Annualized loss expectancy (ALE) = Single loss expectancy (SLE) X  
\[\text{The annualized rate of occurrence (ARO)} \tag{1}\]  
where ARO is the annual rate of occurrence of cyber threat, and SLE is calculated as:  
\[\text{SLE = Asset value X exposure factor} \tag{2}\]  
The ALE can be well described in terms of TCO. TCO includes all costs, such as human resources, software, and hardware in the security programs and determines how much investment is made for the security program. By observing the trends and differences between both ALE and TCO, it is possible to define the benefit of security investment, as shown in Figure 8.  
The EVA of the security investment can be calculated as:  
\[\text{EVA = }\Delta\text{ALE}/\Delta\text{TCO} \tag{3}\]  
Using the above formulation and Figure 8, the EVA should always be less than one for better and cost-effective security investment. Whereas, if EVA is greater than one, it means the cost of security investments is not enough to pay off the potential loss of business assets. Finally, if EVA is equal to one according to the above Formula (3), security cost can compensate for the potential loss. Figure 8: Example of ALE and TCO trends. Maturity assessment: it measures the organization's maturity in securing the information system and business process using a suitable set of security controls recommended from risk assessment output.