Measures and Metrics

Good metrics are SMART:

• Specific: they have a clear purpose
• Measurable: they can be defined in a qualitative or quantitative way
• Achievable: people can feel that, even if the metrics require more effort than the normal, they can be achieved
• Relevant: they are important to business results
• Time-based: they have relevance in time

These articles can provide you some examples:

• ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/
• Key performance indicators for an ISO 27001 ISMS https://advisera.com/27001academy/blog/2016/02/01/key-performance-indicators-for-an-iso-27001-isms/
• Setting the business continuity objectives in ISO 22301 https://advisera.com/27001academy/blog/2014/02/17/setting-the-business-continuity-objectives-in-iso-22301/