23 docs tagged with "métricas"

Reinforced recommendations for organisations with high maturity or demanding normative requirements

Six cross-cutting dimensions for measuring the health of the SbD-ToE programme, aggregating domain indicators from all chapters for executive and risk management visibility.

Technical and process indicators specific to the domain of organisational security governance (GOV), with thresholds by risk level and mapping to the cross-cutting governance dimensions of SbD-ToE.

Examples of KPIs and targets for different organisational profiles

Reference diagrams of the SbD-ToE measurement architecture - layer cascade, chapter-dimension mapping, and adoptability funnel.

Technical and process indicators for assessing the quality, coverage and currency of application risk classification, with thresholds per risk level and mapping to SbD-ToE cross-cutting governance dimensions.

Technical and operational indicators for the assessment of the effectiveness of security controls in container images and orchestration environments, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and operational indicators for the assessment of the effectiveness of the controls for dependency management, SBOM generation and software composition analysis, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and operational indicators for assessing the effectiveness of security controls in Infrastructure as Code, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and operational indicators for the assessment of the effectiveness of the security monitoring programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and process indicators for assessing the effectiveness of secure architecture controls, with thresholds per risk level and a mapping to the SbD-ToE cross-cutting governance dimensions.

Technical and operational indicators for assessing the effectiveness of security controls in continuous integration and delivery pipelines, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and operational indicators for the assessment of the effectiveness of the security controls in the deployment process and release management, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and process indicators for the assessment of the effectiveness of secure development controls, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and process indicators for assessing the coverage, traceability and effective validation of the security requirements applied by risk level, with mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and operational indicators for the assessment of the effectiveness of the security testing programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and process indicators for assessing the coverage, quality and integration of threat modelling in the development cycle, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Technical and process indicators for the assessment of the effectiveness, coverage and impact of the security training and onboarding programme, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Definition and calculation of indicators such as MTTD and MTTR, and their application in operational dashboards.

Principles and practices to ensure visibility, detection and effective response in production environments

Organisational policy that defines the requirements for active monitoring after each deploy to production, including a mandatory observation window, minimum health metrics, alert thresholds, human validation and rollback activation criteria, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the requirements for the definition, collection, analysis and reporting of security governance KPIs, including metric categories, reporting cadence, responsibilities, intervention thresholds and integration with maturity frameworks (SAMM, SSDF), proportionate to the criticality level (L1, L2, L3).

Operational and institutional metrics that make it possible to assess the effectiveness of training and onboarding.