A survey by Tripwire, Inc., and the Ponemon Institute reveals that while 75 percent of respondents say metrics are ‘important’ or ‘very important’ to a risk-based security program, 53 percent don’t believe or are unsure that they are used in their organizations are properly aligned with business objectives.

In addition, 51 percent didn’t believe or are unsure that their organizations metrics adequately convey the effectiveness of security risk management efforts to senior executives

When asked, “Why don’t you create metrics that are well understood by senior executives?”

• :59 percent said the information is too technical to be understood by non-technical management
• 48 percent said pressing issues take precedence
• 40 percent said they only communicate with executives when there is an actual security incident
• 35 percent said it takes too much time and resources to prepare and report metrics to senior executives
• 18 percent said senior executives are not interested in the information

Commenting on these results, Dr. Larry Ponemon, chairman and founder of the Ponemon Institute, said, “Even though most organizations rely on metrics for operational improvement in IT, more than half of IT professionals appear to be concerned about their ability to use metrics to communicate effectively with senior executives about security.”

For more information about the survey please visit: http://www.tripwire.com/ponemon/2013/#metrics.