Ensure security activities support business objectives and enterprise strategy

Optimize security investments to support organizational objectives

Ensure risks are appropriately managed within acceptable levels

Use security knowledge and infrastructure efficiently and effectively

Monitor and report on security processes to ensure objectives are achieved

Key Performance Indicators measure operational effectiveness

Key Risk Indicators provide early warning of increasing risk

Key Goal Indicators measure progress toward objectives

Critical Success Factors define what must go well for success