Spreadsheet: 469211d1467819056-conditional-formating-with-percentages-and-3-colors-example
Sheet: Key Risk Indicators - 2016 June

ID | Measure | Action Triggers | Action(s) Expected | Leading | Lagging | Calculation | Lower Threshold | Moderate Threshold | High Threshold | Owner | 2016 | [NAME] | YTD | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec
1.1 | How many unauthorized devices were on the network? | If the percentage is above 4% or is trending towards High it's an indication there is a breakdown in a process to inventory devices. | Identify cause, develop plan, and address gap(s). | Leading | Divide the highest value over the past month by total number of assets on the network. | <1% | 1% - 4% | >5% | [NAME] | Long Term |  |  | 0.03 | 0.05 | 6
2.1 | How many unauthorized applications have been on the network in the past month? | If the percentage is above 4% or is trending towards the High it's an indication there is a breakdown in a process to inventory applications. | Identify cause, develop plan, and address gap(s). | Leading | Divide the highest value over the past month by the total number of applications on the network. | <1% | 1% - 4% | >5% | [NAME] | Long Term
3.1 | What percentage of systems (applications, network gear, servers, etc.) are not compliant with security configuration benchmarks/baselines? | Indicates security configuration is not being maintained over time if it trends toward High. | Identify cause, develop plan, and address gap(s). | Leading | Divide the total non-compliant by the total assets over the past month.  * not including workstations ** not including exceptions | <1% | 1% - 4% | >5% | [NAME] | Long Term
4.1 |  | Identifies an exposure to the company that will likely be exploited in the very near term if not remediated. | Expedite remediation. | Lagging | Provide the most recent value from the past month. | 0 | 1 | 2 | [NAME] | 2016 | 0 | N/A | N/A | 0 | 0 | 0 | 0
- | How long does it take, on average, to remediate High criticality network vulnerabilities? | Indicates there is a failure in the remediation process if the metric trends towards High. | Identify cause, develop plan, and address gap(s). | Leading | Average the total number of High criticality vulnerabilities identified over the last month. | <30 days | 30 - 90 days | > 90 days | [NAME] | Long Term
5.4 | What percentage of elevated accounts do not require multi-factor authentication? |  |  | Lagging | Divide the total number of privileged accounts using 1-factor by total number of privileged accounts. | <1% | 1% - 4% | >5% | [NAME] | Long Term
19.x |  | Indicates better or worse reporting on incidents or an increase or decrease of attacks or human errors. | Identify cause, develop plan, and address gap(s). | Lagging | Count the total number of compromises over the past month. | Trending | Trending | Trending | [NAME] | 2016 | N/A | N/A | N/A | N/A | N/A | N/A | N/A
7.5 | What percentage of users have failed the phishing test? |  |  |  | From the latest test, take the total number of failed tests and divide by the total number of users who were part of that phishing test. | <1% | 1% - 4% | >5% | [NAME] | Long Term
8.1 |  | Indicates there is a failure in the process if it trends up. | Identify cause, develop plan, and address gap(s). | Lagging | Divide the total number of outdated systems by the total number of systems in scope to receive anti-malware software. | <1% | 1% - 4% | >5% | [NAME] | 2016 |  | N/A | N/A | 0 | 0 | 0
8.6 | How long does it take to remove malware on average? |  |  |  | Average the total number of minutes to remove malware over the last month.  E.g., If there were 10 infected machines from the first of the month to the end of the month and it took a total of 120 minutes to remediate, the average would be 12 minutes. | 60 minutes | 1 day | 1 week | [NAME] | Long Term
9.1 | What is the percentage of servers and workstations that are not running a host based firewall? |  |  |  | Divide the total number of systems not running firewalls by the total number of systems that should be running firewalls. | <1% | 1% - 4% | >5% | [NAME] | Long Term
10.1 | What percentage of systems have not been backed up in the last xyz? |  |  |  | Divide the total number of systems not successfully backed up by the total number of systems that should be backed up. | <1% | 1% - 4% | >5% | [NAME] | Long Term
10.3 | What percentage of backups have not been tested in the last 90 days? |  |  |  | Divide the total number of systems not successfully tested by the total number of systems that should be tested. | <1% | 1% - 4% | >5% | [NAME] | Long Term
15.5 | How long does it take for unauthorized wireless access devices to be isolated/removed from the network? |  |  |  | Average the total number of minutes to remove/isolate unauthorized devices over the last month. | 60 minutes | 1 day | 1 week | [NAME] | Long Term
16.3 | How many attempts to gain access to password files have been detected? |  |  |  | Count the number of attempts. |  |  |  | [NAME] | Long Term
17.1 |  | Indicates there is a failure in the process if it trends up. | Identify cause, develop plan, and address gap(s). | Lagging | Divide the number of employees who have not taken the annual training by the total number of employees who are required to. | <1% | 1% - 4% | >5% | [NAME] | 2016 |  | N/A | 0.36 | 0.05 | 0.0005 | 0.0005 | 0.0005
18.1 | What percentage of custom applications have not had their code scanned? |  |  |  | Divide the number of applications that have not been scanned by the total number of applications in scope to be scanned. | <1% | 1% - 4% | >5% | [NAME] | Long Term
18.3 | How many High criticality application vulnerabilities/bugs exist? |  |  |  | Count the number of High criticality vulnerabilities/bugs. |  |  |  | [NAME] | Long Term
- | How long does it take, on average, to remediate application vulnerabilities/bugs? |  |  |  | Average the total number of High criticality vulnerabilities/bugs identified over the last month. | <30 days | 30 - 90 days | > 90 days | [NAME] | Long Term
- |  | Indicates there is a failure in the process if it trends up. | Identify cause, develop plan, and address gap(s). | Leading | Divide the number of failed tests by the number of tests required for last month. | <1% | 1% - 4% | >5% | [NAME] | 2016 |  | 0 | 0 | 0.04 | 0 | 0 | 0.04
- | What percentage of full time developers have not completed applications security awareness training? | Indicates there is a failure in the process if it trends up. | Identify cause, develop plan, and address gap(s). | Lagging | Divide the number of employees who have not taken the annual training by the total number of employees who are required to. | <1% | 1% - 4% | >5% | [NAME] | Long Term
- | Percentage of controls correctly implemented? | Indicates our level of compliance to Digi-Key standards. | Identify cause, develop plan, and address gap(s). | Lagging | Divide the number of controls passed by the total number of controls. | <1% | 1% - 4% | >5% | TBD | Long Term