Control statement
Develop, monitor, and report on the results of information security and privacy measures of performance.
Discussion
Measures of performance are outcome-based metrics used by an organization to measure the effectiveness or efficiency of the information security and privacy programs and the controls employed in support of the program. To facilitate security and privacy risk management, organizations consider aligning measures of performance with the organizational risk tolerance as defined in the risk management strategy.
From control text to operational evidence
Use Measures of Performance as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to enterprise program governance, accountability, resources, metrics, and organization-wide risk decisions.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- program charters and policies
- governance meeting records
- risk and performance metrics
- resource and responsibility assignments
Common failure patterns
- program metrics count activity instead of outcomes
- system-level risks never reach enterprise governance
- responsibilities assigned without authority or resources
- privacy and security managed in separate silos
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PM-06[01]information security measures of performance are developed;
- PM-06[02]information security measures of performance are monitored;
- PM-06[03]the results of information security measures of performance are reported;
- PM-06[04]privacy measures of performance are developed;
- PM-06[05]privacy measures of performance are monitored;
- PM-06[06]the results of privacy measures of performance are reported.
Examine
- Information security program plan
- privacy program plan
- information security measures of performance
- privacy measures of performance
- procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance
- risk management strategy
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for developing, monitoring, and reporting information security and privacy measures of performance
- mechanisms supporting the development, monitoring, and reporting of information security and privacy measures of performance
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.