Which metrics show progress in each NIST CSF 2.0 function?

NIST CSF 2.0 expects you to measure progress but leaves the metrics to you. Here is how NIST SP 800-55 defines a good measure, and a starter set of metrics for Govern, Identify, Protect, Detect, Respond and Recover that a board will read.

Sean Crowley

President & Co-Founder

October 24, 2026 · 5 min read

Key takeaways

NIST CSF 2.0 describes outcomes and leaves the choice of metrics to each organization.
Subcategory GV.OV-03 calls for cybersecurity risk management performance to be evaluated and reviewed for adjustments.
NIST SP 800-55 Volume 1 sorts measures into implementation, effectiveness, efficiency and impact types.
NIST advises that with quantitative metrics, at least at the start, less is often more.
Qualitative maturity ratings are useful context, but NIST does not treat them as measurements.

Does NIST CSF 2.0 tell you which metrics to track?

No. NIST CSF 2.0 describes outcomes, and it leaves the choice of measures to each organization. It does expect that progress gets measured and reported. Section 5.1 describes practitioners giving managers and executives "the information (e.g., key performance indicators, key risk indicators)" they need, and "measuring changes in operational risk to help plan, carry out, and monitor specific cybersecurity activities." The Govern function makes the review explicit: GV.OV-03 calls for organizational cybersecurity risk management performance to be "evaluated and reviewed for adjustments needed."

For the CCO or COO of an advisory firm, that review is where a board, an investment committee or an examiner will start. A Current and Target Profile tells them where you want to be. A small set of metrics, a mix of key performance indicators (KPIs) and key risk indicators (KRIs), tells them whether you are getting there.

What is the difference between a measure and a metric?

NIST draws a clear line. In SP 800-55 Volume 1, published in December 2024, measures are "quantifiable and objective values that result from measurement," and metrics are "measures and assessment results designed to track progress, facilitate decision-making, and improve performance."

The same guide sorts measures into four types:

Implementation measures "demonstrate the progress of specific controls." NIST's example is the percentage of systems with approved system security plans.
Effectiveness measures "evaluate how well implementation processes and controls are working."
Efficiency measures "examine the timeliness of controls."
Impact measures "articulate the impact of information security on an organization," such as the share of budget devoted to security controls.

Small firms tend to report only implementation measures, because they are easy to count. A mix that includes at least one effectiveness or efficiency measure per function gives leadership a truer picture.

How many NIST CSF 2.0 metrics should a small firm track?

Fewer than you think. SP 800-55 Volume 1 advises that with quantitative metrics, at least at the start, less is often more. Two or three metrics per CSF function, around a dozen in total, is enough for a quarterly report a partner or board member will actually read. Each one should have an owner, a data source you already have, and a target that ties to your Target Profile.

NIST also cautions that "qualitative and semi-quantitative assessments are not considered measurements." A maturity rating of 3 out of 5 can still be useful in a profile, and it works best as context beside your metrics.

Which metrics show progress in Govern and Identify?

Govern metrics show whether leadership is directing the program; Identify metrics show whether you know what you are protecting. The examples below are starting points, each anchored to a CSF 2.0 subcategory.

Govern: percentage of policies reviewed and approved on schedule (GV.OV-01 and GV.OV-02 call for the strategy to be reviewed and adjusted).
Govern: percentage of critical suppliers with a current risk review on file (GV.SC-07 asks that supplier risks be "assessed, responded to, and monitored over the course of the relationship").
Identify: percentage of devices and applications in the inventory that match what your management tools actually see (ID.AM-01 and ID.AM-02).
Identify: number of open improvement items from assessments, tests and incidents, and their average age (ID.IM-01 through ID.IM-03).

Which metrics show progress in Protect?

Protect metrics should show that safeguards are in place and working. Useful choices:

Percentage of accounts with phishing-resistant or app-based MFA enforced.
Number of accounts with administrative rights, tracked against the prior quarter (PR.AA-05 calls for access permissions that follow least privilege and are reviewed).
Percentage of staff who completed security awareness training on time (PR.AT-01).
Percentage of critical patches applied within your target window (PR.PS-02 covers software maintained "commensurate with risk").
Percentage of backup restore tests that succeeded this quarter (PR.DS-11 requires backups to be "created, protected, maintained, and tested").

The last two are efficiency and effectiveness measures. They answer the question an examiner tends to ask next: the control exists, but does it work, and how fast?

Which metrics show progress in Detect, Respond and Recover?

These functions are measured in time. Detect metrics show how quickly you find trouble, and Respond and Recover metrics show how quickly you contain it and get back to work.

Detect: percentage of devices and cloud accounts sending logs to monitoring (DE.CM-01 and DE.CM-09).
Detect: median time from alert to triage by your monitoring team.
Respond: median time from a declared incident to containment, and whether third parties were brought in per the plan (RS.MA-01).
Respond: percentage of incidents with a documented root cause (RS.AN-03).
Recover: time to restore a critical system in your last test, against your recovery objective (RC.RP-01).
Recover: whether backup integrity was verified before the last restore (RC.RP-03).

If your firm had no incidents this quarter, report tabletop exercise results in their place. A tested plan is evidence; an untested plan is an assumption.

How should you report metrics to leadership?

Report trends against targets, with one sentence of interpretation per metric. CSF 2.0 notes that updated results "can be shared through risk registers and progress reports," and GV.RR-01 places accountability for cybersecurity risk with organizational leadership.

For firms under the FTC Safeguards Rule, the Qualified Individual must report in writing, regularly and at least annually, to the board or a senior officer on the overall status of the program and material matters, and the program must be evaluated and adjusted based on testing and monitoring results. A quarterly CSF metrics page makes that annual report far easier to write. SEC-registered advisers can use the same page to support the annual compliance program review. Our pieces on the Govern function and on building a profile cover the surrounding structure.

What should you do this quarter to start measuring CSF progress?

Pick two or three metrics per function from the lists above, about a dozen in total.
For each, name an owner, a data source and a target linked to your Target Profile.
Include at least one effectiveness or efficiency measure in Protect, such as restore test success or patch timeliness.
Capture a baseline now, so next quarter's report shows a trend.
Put the results on one page with a sentence of interpretation each, and add it to your leadership or board agenda.
Retire any metric that has not changed a decision in two quarters.

How does s90 help firms measure CSF progress?

s90 runs NIST CSF 2.0 programs for professional services firms and builds the quarterly metrics page from the tools we already manage, so the numbers come straight from the systems themselves. If you want help choosing a starting set of metrics or turning them into a report your board will read, we would be glad to walk through it with you.

Applies to

Industry

Financial Services

Compliance

NIST CSF 2.0 FTC Safeguards Rule

Regulation reference

NIST SP 800-55 Vol. 1, Measurement Guide for Information Security: Volume 1, Identifying and Selecting Measures (December 2024)
Guidance, not a requirement. Defines measures (quantifiable, objective values from measurement) and metrics (measures and assessment results designed to track progress, facilitate decision-making and improve performance); describes implementation, effectiveness, efficiency and impact measures; states that qualitative and semi-quantitative assessments are not measurements; advises that with quantitative metrics, initially at least, less is often more. Supersedes SP 800-55 Rev. 1.
csrc.nist.gov/pubs/sp/800/55/v1/final
NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, Section 2 and Appendix A (CSF Core)
Voluntary framework. Organizes cybersecurity outcomes into six Functions (Govern, Identify, Protect, Detect, Respond, Recover), each divided into Categories such as GV.SC supply chain risk management, ID.AM asset management, ID.RA risk assessment, PR.AA identity management and access control, DE.CM continuous monitoring, RS.MA incident management and RC.RP incident recovery plan execution.
nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, GOVERN (GV)
Voluntary framework published February 26, 2024. The GOVERN function covers establishing, communicating and monitoring cybersecurity risk management strategy, expectations and policy, across six categories: GV.OC, GV.RM, GV.RR, GV.PO, GV.OV and GV.SC. GV.RR-01 states that organizational leadership is responsible and accountable for cybersecurity risk.
nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
16 CFR 314.4(a), (i) and (j)
Requires a designated Qualified Individual to oversee and implement the information security program, with added conditions if the role is outsourced; requires that person to report in writing, regularly and at least annually, to the board or a senior officer on overall program status and material matters; and requires notice to the FTC within 30 days of discovering unauthorized acquisition of unencrypted information of at least 500 consumers.
www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
16 CFR 314.4(g)
Evaluate and adjust the information security program in light of testing and monitoring results, any material changes to operations or business arrangements, risk assessment results, or other circumstances that may have a material impact on the program.
www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4

Related insights

All insights

Six identical closed Dell laptops stacked neatly on a pale wood table.

CIS Controls

CIS Control 15: how should a small firm manage service providers?

CIS Control 15 has seven safeguards for managing the vendors that hold your data or run your systems. Here is which ones apply at each Implementation Group, what a usable provider inventory looks like, and how Control 15 maps to Reg S-P and the FTC Safeguards Rule.

October 24, 20266 min read

Stacked client folders and printed returns beside a monitor at an empty workstation.

AccountingIRS written information security plan

How to Evaluate AI Tax Software Add-Ons Before They Read Client Files

AI features in tax and practice management software can read client files under new terms. Here is a step-by-step checklist for evaluating an AI tax software add-on against Section 7216, the AICPA Code and the FTC Safeguards Rule.

October 18, 20265 min read

An empty conference room with a long wood table and black chairs, a wall-mounted screen, and a full-height window looking out over the ocean.

Financial ServicesSEC Regulation S-P

ChatGPT for Financial Advisers: Use It Without Leaking Client Data

Advisers are already using ChatGPT and Claude. The question for a CCO is whether client data goes into a firm-controlled account or a personal one. Here is how to set up AI use that holds up under Reg S-P and an SEC exam.

October 17, 20265 min read