ISO 27001 does not prescribe specific KPIs. It requires you to measure the effectiveness of your information security management system (ISMS) based on your risks and objectives. In a digital transformation context, useful KPIs focus on how well controls are working across your evolving systems, not just on whether documentation exists.
1. Governance & ISMS effectiveness KPIs
- Risk treatment coverage: % of identified information security risks with an approved risk treatment plan and assigned owner.
- Overdue risk actions: % of risk treatment actions past due date.
- Control implementation status: % of applicable Annex A controls implemented and operationalized (not just documented).
- ISMS audit nonconformities: Number and severity of internal ISMS audit findings per quarter, and % closed on time.
- Exception management: Number of approved security exceptions and % with defined expiry/review date.
2. Incident and response KPIs
- Information security incident rate: Number of security incidents per month, segmented by severity and system type (e.g., MES, ERP, OT network).
- Mean time to detect (MTTD): Average time from occurrence to detection of a security incident.
- Mean time to respond (MTTR): Average time from detection to containment/eradication for incidents.
- Containment within SLA: % of incidents contained within agreed response time targets.
- Production impact: Number of incidents that required production stops, manual workarounds, or configuration rollbacks.
In regulated manufacturing, it is useful to link incident KPIs to production and quality impact (e.g., batch rework, delayed shipments), while avoiding any implication that these metrics alone prove compliance.
3. Access control & identity management KPIs
- Access review completion: % of required periodic access reviews completed on time for critical systems (MES, QMS, ERP, PLM, OT gateways).
- Access discrepancies: Number of inappropriate or orphan accounts identified in each review (e.g., terminated employees with active OT access).
- Privileged access usage: Number of privileged access sessions per period and % with complete logs and approvals.
- Joiner/mover/leaver timeliness: % of user access changes executed within defined SLA after HR events.
- Multi-factor authentication (MFA) coverage: % of externally accessible and safety-critical systems protected by MFA.
In brownfield plants with many legacy systems, it is common that certain equipment or applications cannot support modern identity controls. KPIs should make this visible rather than masking it.
4. Change management & configuration control KPIs
- Security impact assessment coverage: % of changes to digital systems (MES, historian, OT network, cloud platforms) with documented information security impact assessment.
- Unplanned changes: % of changes executed outside the formal change process (e.g., emergency patches to production controllers).
- Change-related incidents: Number of security incidents or near misses linked to misconfigurations or failed changes.
- Patch latency: Median time to deploy critical security patches for servers, workstations, and OT assets where patching is allowed.
- Rollback events: Number of security-driven changes that required rollback due to production or validation impact.
In regulated and validated environments, patch latency and change throughput are constrained by qualification and downtime limits. KPIs should reflect realistic, risk-based patching policies, not generic IT targets.
5. Backup, recovery & continuity KPIs
- Backup coverage: % of critical systems and configurations (including PLC/robot programs and recipes) covered by tested backups.
- Backup success rate: % of scheduled backups completed successfully.
- Recovery time vs target: Average recovery time for critical systems compared to defined recovery time objectives (RTOs).
- Recovery tests: Number of successful restore tests per quarter for representative systems, with evidence retained.
- Data integrity issues: Number of restore attempts where backups were incomplete, corrupted, or not traceable to correct versions.
For ISO 27001 and regulated industries, it is important that these KPIs are backed by auditable evidence (logs, change records, test reports), not just summary charts.
6. Supplier and third-party risk KPIs
- Critical supplier security assessment coverage: % of critical digital suppliers (cloud platforms, MES vendor, system integrators, remote support providers) with a completed security assessment.
- Contractual control coverage: % of key supplier contracts that include information security and data protection clauses aligned with your ISMS.
- Third-party incident reporting: Number of security incidents originating from or involving third parties, and % reported within agreed timeframes.
- Remote access governance: % of vendor remote access sessions with pre-approval, time limits, and session logging.
7. Training, awareness & behavior KPIs
- Training completion: % of staff in key roles (operators, engineers, maintenance, quality, IT/OT) who have completed required security and data handling training.
- Refresher timeliness: % of staff with training refreshed within defined intervals.
- Phishing simulation results: Click-through rate and reporting rate for controlled phishing tests, where appropriate and culturally accepted.
- Policy exception requests: Number and trend of requests for exceptions to security policies in production environments.
Training KPIs should be tied to specific risks, such as handling of export-controlled technical data, use of portable media on OT networks, or remote access behavior, rather than generic awareness scores.
8. Data protection & information handling KPIs
- Data classification coverage: % of key systems and repositories with documented information classification and handling rules.
- Uncontrolled data stores: Number of “shadow” or ungoverned data stores identified (e.g., uncontrolled file shares, local historian exports).
- Encryption coverage: % of applicable data flows and storage locations with encryption configured and monitored, according to your policy.
- Export-controlled/regulated data breaches: Number of incidents involving misrouted or misclassified regulated technical data.
9. Digital transformation context & brownfield constraints
- Legacy system exposure: Number or % of critical legacy assets that cannot meet target security baselines (e.g., unsupported OS, no MFA capability), with documented compensating controls.
- Integration security coverage: % of new integrations (APIs, data pipelines, OT/IT bridges) with documented security requirements and testing.
- Shadow IT / shadow OT findings: Number of unapproved digital tools, cloud services, or networked devices identified per quarter.
- Validated system impact: Number of security changes that required revalidation of regulated systems, and average elapsed time to complete that revalidation.
Full replacement of legacy systems to improve ISO 27001 posture is often impractical in aerospace-grade or similar environments. Qualification and validation burdens, downtime constraints, and integration complexity usually mean a coexistence strategy is required. KPIs should therefore highlight where legacy constraints force compensating controls, rather than assume everything can be modernized quickly.
10. How to select and use ISO 27001 KPIs in practice
- Start from your risk assessment and legal/regulatory obligations, not from a generic KPI list.
- Ensure each KPI has clear data ownership and collection methods, ideally automated where feasible and validated in regulated systems.
- Align KPIs with existing plant performance and quality dashboards instead of building a separate, disconnected security dashboard.
- Retain evidence and traceability behind the KPIs (logs, tickets, approvals, test results) to support internal and external audits.
- Review KPIs periodically and retire metrics that no longer provide decision value.
None of these KPIs guarantee certification or regulatory compliance. They provide a structured way to monitor whether your ISO 27001 controls are effective as you digitize more of your manufacturing and engineering environment, within the limits of your existing systems, validation status, and integration maturity.
