IT Security

% of downtime due to security incidents

% of email spam messages stopped/detected

% of email spam messages unstopped/undetected

% of hours devoted to train tecnichal staff in IT security compared with the total ones

% of patches applied outside of maintenance window

% of spam false positives

% of systems covered by antivirus/antispyware software

% of systems not to policy patch level

% of systems with latest antivirus/antispyware signatures

% of virus incidents requiring manual cleanup

% of virusses & spyware detected in email

Cost of cleanup of virus/spyware incidents

Cost of patches

Distribution cycle of patches

Frecuency of IT security audits

Latency of unapplied patches

Number of detected network attacks

Number of hours spent in IT Security training

Number of occurrences of loss of strategic data

Number of outgoing virusses/spyware caught

Percent of incidents classified as security related

Risk Level Matrix

Security Implementation Duration

Security Incident Resolution Time by Severity

Security vulnerability density per 1,000 lines of code

Spam detection failure %

Weighted security vulnerability density per unit of code