KPIs in the ISMS
I inherited the role from someone else, and I am trying to simplify some things. One of those things is the KPIs of our ISMS.
Currently, we do have around 15 KPIs that are not clearly defined and are somewhat open to interpretation, and they are linked to specific controls. Example:
A.8.21 Segregation of Network Services (no formula to calculate that); it seems incidents that touch that point were counted.
I am aware KPIs have to be set in consultation with management after introspection, but for the time being, while I get things under control. I wanted to ask you how many KPIs you have in your ISMS?
And do you explicitly link them to a single control?
I checked with AI tools about this topic; it gave me a more structured answer, but I want to compare those notes with real-world practice.
Any insight?