Goal-Question-Metric is a method for deriving metrics from objectives rather than from whatever data happens to be available. Victor Basili and colleagues developed it in the 1980s for software engineering measurement, and it transfers to security almost without modification.
State the goal at the conceptual level. What outcome, for whom, in what context.
Derive the questions that would tell you whether the goal is being met. These are in plain language and there are usually three to five per goal.
Derive the metrics that answer each question. Some questions need several. Some will turn out to need data you do not have, which is itself a finding.
The direction of travel is what matters. Goals first, data last.
Goal: reduce the likelihood that a ransomware event disrupts operations for more than four hours.
Questions. Can we restore the systems that matter, and do we know because we tested? How long does an intrusion go undetected in the estate that matters? How quickly can we isolate a compromised segment? Do the people who would run the response know their part?
Metrics. Share of tier-one systems with a verified restore inside 90 days. Median dwell time on detected intrusions. Time to isolate in the last exercise. Share of response roles exercised in the last two quarters, with evidence.
Note what happened. Two of those four metrics cannot be produced from a security tool. The exercise data and the restore verification live in documents and people’s calendars. Deriving from goals surfaces that gap rather than routing around it.
Building upward from available data produces a large set of metrics that are individually defensible and collectively answer no question. Everyone recognises the result: a pack of thirty numbers where nobody can say which goal any of them serves.
GQM also makes retirement possible. A metric traceable to a question traceable to a goal can be removed when the goal changes. A metric with no such trace never gets removed, because nobody can prove it is not needed. See metric sprawl.
From the blog