- Incident metrics, including the number of breaches and unauthorized access attempts.
- The meantime to detect (MTTD) and respond (MTTR) to security issues and the speed of identifying and resolving threats.
- Pass/fail rates for GDPR, HIPAA, and other compliance requirements.
- Vulnerability metrics, including open vulnerabilities and patching frequency.
- Training completion, such as the percentage of staff trained on security protocols.
- The percent of sensitive data encrypted.
- Access control metrics for addressing least-privilege access.
- Percentage of data cataloged by severity and criticality (this metric works in collaboration with the data governance function).
Dataops, governance, and security metrics in practice
Kajal Wood, VP of software engineering at Capital One, shared a detailed perspective on how to put the theory of data effectiveness into practice. “Measuring effectiveness starts with building a well-governed and high-quality data ecosystem. To do this, we consider data quality metrics like accuracy, completeness, accessibility, and availability, to ensure teams can trust and use data effectively. Observability and security KPIs like data lineage coverage, ensuring all shared and used data is registered in the catalog, sensitive data detection and remediation, and incident response times demonstrate governance maturity. Dataops efficiency metrics like pipeline deployment speed, automation rates, and consumption experience reflect agility.”
The goal of such an encompassing list of metrics, Woods adds, “is to align these metrics with business outcomes—faster innovation, reduced risk, and improved decision-making—to unlock tangible value from data.”
A mature, data-driven organization can support metrics like these, but it takes time to develop the practices. Starting with fewer meaningful metrics is often better than having too many. Put your metrics through a simple three-question test: