Most security dashboards report deployment: how many endpoints have the agent, how many assets are scanned, how many users have MFA. Those numbers matter. They do not tell you whether the control works. A board that sees 98% coverage and assumes 98% protection has read the wrong number.
The four kinds of measure
NIST SP 800-55 Volume 1 (December 2024) sorts information security measures into four types. Implementation measures show progress of specific controls, usually as percentages, such as the share of servers with a standard configuration. Effectiveness measures evaluate how well controls work and whether they meet desired outcomes. Efficiency measures look at timeliness: how fast controls give useful feedback and how quickly issues are addressed. Impact measures tie security to mission, goals and costs, including cost savings, costs of security events, regulatory fines and contractual penalties. NIST notes that effectiveness and efficiency together are often called program results.
The guide adds that implementation measures are never fully retired because they record what exists. Once they are in place, the program should broaden to effectiveness, efficiency and impact.
| Type | Example | What it cannot tell you |
|---|---|---|
| Implementation | 98% of endpoints run the EDR agent | Whether the agent detects anything |
| Effectiveness | Share of simulated techniques the control detected in the last test | Whether anyone responded |
| Efficiency | Median time from detection to containment | Whether the detection was correct |
| Impact | Cost of incidents against budget; regulatory penalties | Which control caused the change |
What coverage hides: two public cases
| Case | Primary source | Gap between coverage and effect |
|---|---|---|
| NHS and WannaCry, 2017 | UK National Audit Office, investigation report. Before the attack, NHS Digital had run on-site cyber-security assessments at 88 of 236 trusts and none had passed. At least 80 of 236 trusts were affected, which the NAO counts as 34 infected and 46 disrupted. | Assessment ran on only part of the estate. Where it ran, the result was a fail. |
| Equifax, 2017 | House Oversight report. A traffic-monitoring device was inactive for 19 months because of an expired certificate (GAO: ten months). Over 300 certificates had expired. | The tool was deployed. It was not seeing traffic. |
Building a detection-evidence measure
Our reading: the strongest effectiveness measure for a detection control is a repeatable test with a recorded result. The pattern is simple.
-
Pick a technique that matters to you, for example credential use from an unusual location or a new remote-management tool appearing on a server.
-
Run the technique safely in a controlled way, on a schedule.
-
Record whether the control detected it, how long it took, and who received the alert.
-
Track the share of tested techniques detected over time, and the time to detect.
-
Feed gaps into the engineering backlog with an owner and a date.
The CSF 2.0 Detect function frames what to look for: DE.AE-02 asks that potentially adverse events are analyzed to understand associated activities, DE.AE-03 that information is correlated from multiple sources, and DE.AE-04 that the estimated impact and scope are understood. Each can be tested.
Reading the numbers
-
A rising coverage percentage with a flat detection rate means you are deploying a tool that does not change outcomes.
-
A high detection rate on a narrow test set is not a high detection rate. Say how many techniques were tested and why those.
-
Time-based measures need a start and a stop. Define both in advance, or two teams will report different numbers for the same event.
-
Impact measures are slow and noisy. Use them for the board. Use effectiveness and efficiency for steering.
Decision
Decision: for each top-ten control, add one effectiveness measure to the report next to its coverage number. If you cannot define one, the control’s purpose is unclear.
What this evidence does not show
Two cases show that coverage can hide failure. They do not show how often. The NAO figures describe the 2017 NHS estate. NIST SP 800-55 Volume 1 is guidance on choosing measures. It does not provide benchmark values. The detection test pattern is Cybrilliant analysis.
A short test
Open your latest security report. Highlight each number as implementation, effectiveness, efficiency or impact. If most are implementation, the report shows effort, not effect.
Sources
-
NIST SP 800-55 Vol. 1, Measurement Guide for Information Security, December 2024. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-55v1.pdf
-
UK National Audit Office, Investigation: WannaCry cyber attack and the NHS, HC 414, 2017-19. Accessed 9 October 2026. nao.org.uk/wp-content/uploads/2017/10/Investigation-WannaCry-cyber-attack-and-the-NHS.pdf nao.org.uk
-
US House Committee on Oversight and Government Reform, Majority Staff Report, The Equifax Data Breach, December 2018. Accessed 9 October 2026. oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
-
NIST Cybersecurity Framework 2.0 (CSWP 29), 26 February 2024. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
-
Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionBuild & Transform CybersecurityTurn a long list of projects into a lasting program.See how we work →Related service
Security Engineering & Optimization
Use this to move control reporting from deployment counts to evidence of effect.