At Forrester, we place a great deal of emphasis on relevance and what it means when researching a topic.  For the busy executive, it's sometimes difficult to wade through deep lists of operational security metrics and really understand how relevant the information is to the mission of the business.  Further to the problem is the need to understand what your metrics say about the security posture of your organization and the health of the business overall.

The draft title of the report I'm currently working on is Information Security Metrics – Present Information That Actually Matters To The Business. In the paper, I plan to focus on the key factors that make security metrics relevant.  The idea here is that if people start checking their BlackBerrys and iPhones while you're presenting your report, it's probably time for some new metrics.

Success is the ability to educate positively the C-Level suite in your organization and demonstrate the value you and your information security program provide.