Cyber resilience metrics — KPIs, KRIs, Board reporting cadence
Primary statement
Cyber resilience metrics operate as: (1) comprehensive metrics programme reporting to Board IT Strategy Committee (RBI GV.6 for Maturity Level 4 banks); (2) defined metrics including detection MTTR, MTTD, vulnerability backlog age, training completion, incident counts and severity, control compliance (RBI DE.6); (3) cybersecurity risk management performance evaluated for adjustments (NIST GV.OV-03); (4) ISRMC oversight for insurance entities (IRDAI GV.4); (5) integration with cyber risk management framework (SEBI GV.4). Metrics are how the Board sees the cyber programme.
Audit-fatigue payoff
A unified metrics programme — KPI definition + KRI inventory + Board reporting cadence + performance evaluation cycle — satisfies metrics requirements across all 9 contributing frameworks. The RBI GV.6 / DE.6 specifications are the audit-defensible ceiling.
Strictness matrix
Scope
Scope: defined set of cyber security metrics — detection MTTR, MTTD, vulnerability backlog age, training completion rate, incident counts and severity, control compliance. Six metric families minimum.
Ceiling source: rbi_csf:RBI.DE.6
Rationale: RBI CSF DE.6 enumerates the broadest metric scope.
Threshold
Threshold for Board reporting: comprehensive metrics programme reporting to Board IT Strategy Committee at defined cadence (typically quarterly). Metrics tied to risk appetite. KPI/KRI distinction maintained.
Ceiling source: rbi_csf:RBI.GV.6
Rationale: RBI CSF GV.6 Board-reporting cadence requirement is the binary threshold for Maturity Level 4.
Method
Method: (1) defined metric set covering technology / process / people / governance; (2) data sources identified per metric; (3) baseline and target per metric tied to risk appetite; (4) collection automated where possible; (5) Board IT Strategy Committee reporting (RBI GV.6) at defined cadence; (6) performance evaluation with adjustment cycle (NIST GV.OV-03); (7) ISRMC oversight for insurance (IRDAI GV.4); (8) integration with cyber risk management framework (SEBI GV.4).
Ceiling source: rbi_csf:RBI.GV.6
Rationale: RBI CSF GV.6 Maturity Level 4 specifications are the most prescriptive.
Frequency
Metric collection: continuous or near-real-time per metric. Board IT Strategy Committee reporting: quarterly typical. Performance evaluation cycle: half-yearly minimum. Metric set review: annual.
Ceiling source: rbi_csf:RBI.GV.6
Rationale: Quarterly Board reporting is the strict cadence for Maturity Level 4.
Evidence
Required evidence: (1) metric definition document with KPIs and KRIs; (2) collection automation evidence; (3) Board IT Strategy Committee reports (quarterly sample); (4) performance evaluation records with adjustments made; (5) risk-appetite linkage; (6) ISRMC minutes (IRDAI GV.4); (7) metric set review records.
Ceiling source: rbi_csf:RBI.GV.6
Rationale: RBI GV.6 evidence is comprehensive. Board IT Strategy Committee reports are the audit anchor.
Auditor test pattern
Step 1: Inspect the metric definition document. Step 2: Verify the six metric families per RBI DE.6 are covered. Step 3: Inspect sample Board IT Strategy Committee report (quarterly). Step 4: Verify metrics are tied to risk appetite. Step 5: Inspect performance evaluation cycle records. Step 6: For insurance entities, inspect ISRMC oversight records (IRDAI GV.4).
Common findings
Common 2024–26 findings: (1) Metrics defined but not tied to risk appetite; (2) Board reporting informational, not actionable; (3) Performance evaluation absent — metrics reported but no adjustments made; (4) MTTR/MTTD reported but no benchmark for comparison; (5) ISRMC for insurance absent; (6) KPI/KRI distinction blurred — leading vs lagging indicators mixed.