What is the point of spending time, resources and money on your security program if you can’t tell whether it’s working or not? It’s just as important to establish the right metrics for a security program as it is to have such a program in the first place. We often say “not everything that gets measured matters, but what matters absolutely should get measured,” and that is just as true for security as any other critical business function. So how should organizations go about measuring the effectiveness of their security program?