Short · Security operations · 1 min read
The Security Dashboard Nobody Can Use
By Dr. Lin Clark
A dashboard can be full of healthy percentages and still leave leadership unable to say whether the organization is safer. Alert counts and closed tickets are easy to display. The harder question is what changed in the exposure that matters.
The operational question
CSF 2.0 links cybersecurity governance with operational outcomes (Pascoe et al., 2024). Before adding a metric, I ask who reads it and what decision it is supposed to change. If nobody knows, the number probably belongs in an operational log.
What the guidance actually says
Incident-response guidance emphasizes effective preparation, detection, response, and recovery (Nelson et al., 2025). I would rather see whether consequential incidents were contained within tolerable time than a triumphant chart showing millions of events ingested.
Where the plan breaks
The NIST controls catalog distinguishes control functionality from assurance (Joint Task Force, 2020). Coverage percentages tell part of the story. Evidence that the most important controls work tells another, often less comfortable one.
The evidence I would ask for
Risk assessments require context about threats, vulnerabilities, likelihood, and impact (Joint Task Force Transformation Initiative, 2012). A single traffic-light score cannot carry that argument. Give leaders decisions supported by evidence, not decorative gauges.
The decision that matters
The Risk Management Framework calls for ongoing assessment and monitoring (Joint Task Force, 2018). Keep measures that reveal changes requiring action and retire the ones nobody uses. Measurement should improve judgment, not consume attention.
If your board report looks impressive but nobody knows what to do next, I can help rebuild it around decisions.
References
- Pascoe, C., Quinn, S., & Scarfone, K. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.CSWP.29
- Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST SP 800-61 Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
- Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
- Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST SP 800-30 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
- Joint Task Force. (2018). Risk management framework for information systems and organizations (NIST SP 800-37 Rev. 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-37r2