NIST releases guidelines for IT security metrics

• By William Jackson
• Aug 13, 2003

The National Institute of Standards and Technology has released its final version of guidelines for developing metrics to help ensure agencies meet IT security requirements.

NIST Special Publication 800-55, Security Metrics Guide for IT Systems is available online.

Requirements for securing and evaluating IT systems are included in a number of laws, including the Clinger-Cohen Act, Government Performance and Results Act, Government Paperwork Elimination Act and the Federal Information Security Management Act. The laws do not specify how the evaluation is to be done, and the NIST document provides guidance on developing and using metrics to do this job.

Metrics'measurable standards'monitor the effectiveness of goals and objectives established for IT security. They measure the implementation of security policy, the results of security services and the impact of security events on an agency's mission. The publication uses the critical elements, and security controls and techniques laid out in an earlier NIST publication, 800-26, Security Self-Assessment Guide for IT Systems.

According to the guidelines, worthwhile metrics must:

Yield quantifiable information, such as percentages, averages or other numbers

Be based on readily available data

Be based on repeatable processes

Be useful for tracking performance and directing resources.