OpenCyber Academy
Postgraduate · Chapter 10 · English
Course code: OCA-140Chapter 10: OCA-140-C010

Chapter 10 — Metrics, reporting and the board

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Measures"]
  N2["10.2 Baselines"]
  N3["10.3 Board report"]
  N4["10.4 Driving decisions"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Measures"]
  N2["10.2 Baselines"]
  N3["10.3 Board report"]
  N4["10.4 Driving decisions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]

[Learning outcomes]
    |
    v
[10.1 Measures]
    |
    v
[10.2 Baselines]
    |
    v
[10.3 Board report]
    |
    v
[10.4 Driving decisions]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) choose measures linked to risks; (2) report to a non-specialist board; (3) use measures to drive decisions.

10.1 Measures

Elena selects six measures linked to top risks: critical patch compliance by clinic, multi-factor enrolment, quarantined lookalike messages, timed recovery test results, former-staff accounts found in reviews and incidents by type. Each has a definition, source, owner and target. She avoids counts that only look impressive, such as blocked connections. Dr. Qureshi notes that each measure should answer a question the board would ask. She writes each definition in the measure handbook, and the central team tests that the figures can be produced from existing systems each month without manual effort.

10.2 Baselines

Elena uses her course work as baselines: patch compliance of 90.6 percent with three clinics far lower, four lookalike domains in the synthetic mail sample, a six-hour first restore and several former staff accounts in the first review. She shows improvement since: clinic patch compliance above ninety percent, quarantining in place and a three-hour restore. Baselines make progress visible to the board. She shows both the baseline and the latest value for each measure in a simple table, so the board can see where progress has been made and where work remains, including the imaging exceptions still open.

10.3 Board report

Elena designs a two-page quarterly report. Page one shows the six measures with trend arrows and a sentence on each. Page two lists top risks, changes since last quarter and decisions needed. The board asks fewer technical questions and more about priorities and resources. One partner asks why imaging computers remain exceptions, prompting a decision to pressure the supplier jointly with other dental groups. The board decides to contact two other dental groups that use the same imaging software and send a joint request to the supplier for an updated, supported version.

10.4 Driving decisions

Measures matter when they change decisions. Elena shows how the clinic patch measure led to support for three clinics and how the restore test led to the local snapshot. She proposes stopping a measure that never changes decisions. Dr. Qureshi notes that measurement systems should be pruned as well as grown, so attention stays on what matters. The committee agrees to stop reporting the number of quarantined messages to the board, keeping it as an internal measure for the central team, because it rose and fell with attacker activity rather than with anything Moorfield controlled.

Worked example

Elena links six measures to risks, uses course results as baselines, writes a two-page board report and shows how measures changed decisions.

Synthetic case. Measures are synthetic.

Errors and limits

Measures that never change decisions waste attention.

Exercises

Worked answers

EX046. Six measures.

EX047. Blocked connections.

EX048. Two pages.

EX049. To pressure the supplier jointly with other dental groups.

EX050. Stopping measures that never change decisions.