Cyber Team SLA & KPI Library
KPIs, SLAs and performance measures for 30 security roles, from CISO and GRC to SOC, engineering and offensive security. Every role has 5 KPIs with a formula, starting target, frequency and data source, plus the SLAs it commits to and how to judge the work in a review. Pick a role, press Customise to set your own targets, and download the set with Pro.
Chief Information Security Officer
Owns the security strategy and the cyber risk position of the organisation. Turns business priorities into a funded, measurable programme and keeps the board honestly informed.
Reports to: CEO, CIO or COO, with a regular line to the board or its risk committee
KPIs
| KPI | Definition & formula | Target | Frequency | Data source |
|---|---|---|---|---|
| Top risks within appetite | Share of top-tier cyber risks whose residual rating sits inside the board-approved appetite. Shows whether the programme is actually reducing exposure. Top risks rated within appetite / total top risks x 100 | >= 80% within appetite, with a dated plan for every exception | Quarterly | Enterprise risk register / GRC platform |
| Strategic roadmap delivery | Proportion of planned security initiatives delivered on time and in scope this period. Tracks execution of the agreed strategy. Initiatives delivered on plan / initiatives due this period x 100 | >= 85% of milestones delivered on plan | Quarterly | Programme portfolio / PMO tracker |
| Overdue critical exposures | Count of critical vulnerabilities, audit findings or control gaps past their agreed fix date. A direct read on unmanaged risk. Count of critical items open beyond agreed due date | Zero overdue without an approved, time-boxed risk acceptance | Monthly | Vulnerability management, audit tracker, risk register |
| Material incident impact | Number of incidents that caused material business disruption, data loss or regulatory notification. The outcome the whole programme exists to limit. Count of incidents classified material or notifiable in the period | Downward trend year on year; every one followed by a board-level review | Quarterly | Incident management system / post-incident reports |
| Security budget variance | Difference between planned and actual security spend. Shows financial discipline and credibility with the CFO. (Actual spend - planned spend) / planned spend x 100 | Within +/- 5% of approved budget | Monthly | Finance ledger / cost centre reports |
SLAs
| Service | Commitment | Target | Measured by |
|---|---|---|---|
| Board and risk committee reporting | Cyber risk report with metrics, trends and decisions needed delivered ahead of each meeting | Papers submitted at least 5 business days before the meeting | Board secretary submission log |
| Executive notification of a material incident | CEO and executive team briefed on scope, impact and next steps | Within 2 hours of the incident being declared material | Incident timeline vs executive notification timestamp |
| Risk acceptance and exception decisions | Escalated exception requests reviewed and a decision recorded with rationale | Within 10 business days of a complete request | GRC exception workflow timestamps |
| Regulator and key customer security enquiries | Accountable, accurate response coordinated across legal and compliance | Acknowledged within 2 business days; answered by the requester deadline | Correspondence log with due and sent dates |
Performance measures
| Area | What good looks like | Evidence |
|---|---|---|
| Board communication | Explains cyber risk in business terms, gives clear options and gets decisions rather than just updates | Board minutes, decisions recorded, director feedback |
| Investment judgement | Ties every major spend to a named risk and a measurable reduction, and stops work that is not paying off | Business cases, portfolio reviews, initiatives stopped or re-scoped |
| Leadership of the security function | Builds a stable, skilled team with clear succession for key roles | Retention, engagement survey results, succession plan, open-role time to fill |
| Executive partnership | Business leaders bring security in early instead of working around it | Security involvement at project initiation, peer feedback, escalations avoided |
Starting points, not benchmarks. Targets are common starting values — set your own from your baseline, risk appetite and resourcing.
Need programme-level metrics rather than per-role ones? The Security Metrics Library covers board and programme KPIs, including AI-era metrics.
Security team KPIs: frequently asked
What KPIs should a security team track?
Track a small set per role that ties to what that role is accountable for. A SOC analyst is measured on triage time, escalation accuracy and false-positive rate; a vulnerability management lead on remediation within SLA and exposure age; a GRC manager on control coverage and audit findings closed; a CISO on risk reduction, incident impact and programme delivery. This library gives five KPIs per role for 30 roles, each with a definition, a formula, a starting target, a reporting frequency and the data source you would pull it from.
What is the difference between a KPI, an SLA and a performance measure?
A KPI is a number you trend to see whether a role is achieving its objective, such as mean time to triage. An SLA is a service commitment the role makes to someone else, such as "critical vulnerabilities patched within 15 days" or "P1 incidents acknowledged in 15 minutes", and it is either met or breached. A performance measure is the qualitative side of the job, used in reviews: what good looks like and what evidence shows it. Each role here has all three.
Are the targets industry benchmarks?
No. They are common starting values, not measured industry averages. The right target depends on your baseline, risk appetite, tooling and headcount. Measure your current value for a few cycles, then set a target that improves on it. Customise mode lets you change every target, and your edits stay in your browser.
Is the library free?
Yes. Browsing all 30 roles and customising the KPIs, SLAs and measures is free, with no sign-up. Downloading your customised library as Word, PDF, Excel (CSV) or Markdown, for one role, a whole function or every role at once, is part of Pro.
Which roles are included?
Leadership, Governance, risk & compliance, Security operations, Security engineering & architecture, Offensive security & assurance: Chief Information Security Officer, Business Information Security Officer, Security Program Manager, GRC Manager, Cyber Risk Analyst, Security Compliance Analyst, Privacy Officer / DPO, Security Awareness & Culture Lead, Third-Party Risk Analyst, IT Security Auditor, SOC Manager, SOC Analyst (Tier 1), SOC Analyst (Tier 2/3), Incident Response Lead, Threat Intelligence Analyst, Threat Hunter, Detection Engineer, Digital Forensics & Incident Response Analyst, Vulnerability Management Lead, Security Architect, Cloud Security Engineer, Network Security Engineer, Identity & Access Management Engineer, Application Security Engineer, DevSecOps Engineer, AI Security Engineer, OT / ICS Security Engineer, Data Security Engineer (DLP & encryption), Penetration Tester, Red Team Lead.