Example: KPIs and Targets
Context
SbD-ToE prescribes (Ch. 12):
- ✓ Security metrics
- ✓ Continuous monitoring
- ✓ Data-driven improvement
SbD-ToE does NOT prescribe specific targets because contexts vary. This document presents examples for different types of organisation.
KPI Dimensions (All Organisations)
The manual defines these dimensions (Ch. 12):
- Application Risk - Threat coverage
- Development - Code quality
- Operations - Response time
- Supply Chain - Supplier management
- Compliance - Audit evidence
For each dimension, example targets are presented.
Scenario 1: Payments Fintech (Startup, <50 devs)
Context
- Critical service: Payment processing
- DORA deadline: January 2025 (short)
- Budget: Limited
- Risk appetite: Low (payments = PCI-DSS + DORA)
KPIs and Targets
| Category | Metric | Target | Period | Rationale |
|---|---|---|---|---|
| Application Risk | % apps classified | 100% | M1 | Urgent: DORA requires classification |
| Threat modelling (L3) | 100% | M3 | Before TLPT | |
| Unremediated critical vulns | 0 | Permanent | Payments: zero tolerance | |
| Unremediated high vulns | 0 (or <48h SLA) | Permanent | Direct PCI impact | |
| Development | Test coverage | ≥80% | M6 | Progressive: start with critical functions |
| High SAST findings | 0 | Permanent | CI/CD gate | |
| High SCA findings | 0 | Permanent | CI/CD gate | |
| Operations | MTTR P1 (Critical) | <2h | Permanent | Payments: direct impact |
| MTTR P2 (High) | <8h | Permanent | Business impact | |
| Incidents detected/month | <5 | M12 | Reduce with maturity | |
| Supply Chain | Suppliers in the inventory | 100% | M2 | DORA Art. 28(3) (templates: Implementing Regulation (EU) 2024/2956) |
| % with complete onboarding | 100% | M3 | Before access | |
| % with security training | 100% | M3 | Mandatory before access | |
| Compliance | Policy signed by the board | ✓ | M1 | DORA Art. 5 |
| Audit trail (logs) | 3 years | M0 | Prior requirement | |
| Staff SbD training | 100% devs | M4 | Rapid ramp-up | |
| Inspection readiness | 95% | M12 | Before the supervisor's inspection |
Dashboard (Visual example)
Scenario 2: Traditional Bank (Regional, >200 devs)
Context
- Critical apps:
>30 (multiple business lines) - DORA deadline: January 2025
- Budget: Adequate
- Risk appetite: Very low (historical compliance)
- Additional compliance: GDPR, NIS2, local regulation
KPIs and Targets
| Category | Metric | Target | Period | Rationale |
|---|---|---|---|---|
| Application Risk | % apps classified | 100% | M1 | Mandatory under DORA |
| Threat modelling (L3) | 100% | M4 | More apps = time | |
| Threat modelling (L2) | 80% | M6 | Progressive | |
| Unremediated critical vulns | 0 | Permanent | DORA + GDPR | |
| High vulns (remediation SLA) | <30 days | Permanent | As per Ch. 05 | |
| Medium vulns (remediation SLA) | <90 days | Permanent | As per Ch. 05 | |
| Development | Test coverage | ≥85% | M12 | More rigorous: bank |
| High SAST findings | 0 | Permanent | Zero tolerance | |
| High SCA findings | 0 | Permanent | Zero tolerance | |
| Code review rate | 100% | Permanent | Segregation of duties | |
| Operations | MTTR P1 (Critical) | <1h | Permanent | Systemic impact |
| MTTR P2 (High) | <4h | Permanent | Operational impact | |
| Core app availability | ≥99.95% | Permanent | Regulatory SLA | |
P1 incidents resolved <24h | 100% | Permanent | Internal objective; DORA notification runs in parallel, within the RTS time limits (Policy 32 §6) | |
| Supply Chain | Suppliers in the inventory | 100% | M1 | DORA Art. 26 |
| % audited (risk assessment) | 100% | M3 | Required by DORA | |
| % with an updated contract | 100% | M6 | Technical clauses | |
% with access revoked <24h | 100% | Permanent | Rigorous offboarding | |
| Compliance | Board policy + designated data protection officer (DPO), where applicable | ✓ | M0 | Prior requirement |
| Audit trail (logs) | 5 years | M0 | Internal policy based on risk assessment (DORA: Delegated Regulation (EU) 2024/1774, Art. 12; GDPR Art. 5(1), point (e), where personal data are involved) | |
| Staff SbD training | 100% devs | M6 | Larger volume | |
| Staff GRC training | 100% architecture | M3 | Understand the regulations | |
| TLPT (entities identified by the TLPT authority; critical or important functions) | per a cycle of ≥ 3 years | M12 | DORA Art. 26; Delegated Regulation (EU) 2025/1190 | |
| TLPT attestation | ✓ | M13 | Board evidence | |
| Supervisory inspection readiness | 100% | M18 | Full preparation |
New: A Different Timeline
Key differences:
- Fintech: 12 months, fast foundation (M0-M2), focus on speed
- Bank: 18 months, longer foundation (M0-M3), more apps and complexity
Scenario 3: Digital Insurer (SME, 20-50 devs)
Context
- Apps: Critical subsystems (10-15 L3)
- DORA deadline: January 2025
- Budget: Moderate
- Risk appetite: Low (insurance = sensitive data + GDPR)
- Additional compliance: GDPR, local insurance regulation
KPIs and Targets
| Category | Metric | Target | Period | Rationale |
|---|---|---|---|---|
| Application Risk | % apps classified | 100% | M1 | Mandatory under DORA |
| Threat modelling (L3) | 100% | M3 | Fewer apps = fast | |
| Unremediated critical vulns | 0 | Permanent | GDPR + data | |
| High vulns (SLA) | <15 days | Permanent | Sensitive data | |
| Development | Test coverage | ≥75% | M6 | Pragmatic for an SME |
| High SAST findings | 0 | Permanent | CI/CD gate | |
| High SCA findings | 0 | Permanent | CI/CD gate | |
| Operations | MTTR P1 | <4h | Permanent | Insurance: operational impact |
| MTTR P2 | <24h | Permanent | Less critical than a bank | |
| Availability | ≥99.5% | Permanent | Commercial SLA | |
| Supply Chain | Suppliers in the inventory | 100% | M2 | Required by DORA |
| % with onboarding | 100% | M3 | Before access | |
| % with training | 100% | M3 | Mandatory | |
| Compliance | Board policy | ✓ | M1 | DORA Art. 5 |
| Audit trail | 3 years (internal policy) | M0 | ||
| Staff training | 100% | M4 | SME: everyone is aware | |
| TLPT readiness | Critical L3 pilot | M10 | Fewer apps = feasible | |
| Inspection readiness | 90% | M12 | Before the DORA deadline |
Scenario 4: Outsourcing/Financial Services Company
Context
- Apps: Multiple SaaS/On-prem solutions
- Clients: Different risk profiles
- DORA deadline: Depends on the client
- Budget: Variable (per client)
- Challenge: Different maturity levels per client
Approach: Targets per Tier
| Tier | Client | RTO | High Vulns SLA | TLPT | Training |
|---|---|---|---|---|---|
| Essential | Small bank | <4h | <30d | Yes | 100% |
| Standard | Financial SME | <8h | <45d | Yes | 80% |
| Basic | Fintech startup | <24h | <60d | Pilot | 60% |
Client Management
👤 Each client has:
- App classification (L1-L3)
- Its own policy (signed)
- Customised SLA
- Specific DORA timeline
- KPIs tracked on a dashboard
- Quarterly report
📊 Internal consolidation:
- Aggregate KPI: % compliant clients
- Aggregate risk: Clients at risk
- Training: Coverage per region/client
- Alerts: Clients that will miss the deadline
Components of Any Dashboard
Regardless of the scenario, the dashboard must have:
📊 Unified Dashboard
Review Cadence
Monthly (Quick-check)
- Critical/High vulns
- Open incidents
- Suppliers without onboarding
Quarterly (Formal Review)
- KPIs against targets
- Trends over the last 3 months
- Target adjustments if needed
- Board reporting
Annual (Strategic)
- Review of targets in line with DORA's evolution
- Lessons learned vs. targets
- Projection for the next year
Target-Setting Process (To Do)
- Baseline: Audit the current state
- Benchmarking: Compare with the industry (caution: contexts vary)
- Risk Assessment: Define the risk appetite
- Proposal: Present to management
- Approval: Board sign-off
- Communication: Publish targets, communicate the timeline
- Monitoring: Track progress
- Review: Quarterly + annual
Important
There are no "right targets" - each organisation must:
- Start conservatively (better to exceed than to fail)
- Iterate according to capacity
- Align with the DORA requirements
- Communicate trade-offs
- Document decisions
Targets serve a practical purpose, not a theoretical one - they exist to guide action, not to look good in an audit.
Version: 1.0
Date: November 2025
Review: Quarterly in line with DORA's evolution