From csoonline.com
As solutions to managing cybersecurity threats increase, surprisingly few metrics are available on how well these methods work to secure organizational assets. The National Institute of Standards and Technology (NIST) has pioneered information security performance measurement models that can produce metrics. (Note: NIST’s work in this area is now being updated.)