How do you measure your effectiveness without reporting and analytics? You really can’t. Reports play an extremely important role in an every business, at every level of the company. Security reports are particularly critical given that they can single handedly alter the way a business operates.
What reports should we be looking at? Well, that depends; a good way to start is to decide why we are building the reports in the first place. For example, are we looking for gaps and weakness in an organization’s security posture, are we measuring the effectiveness of our policies and procedures, or are we looking to fulfill a mandated regulatory or compliance initiative. Whatever the case, a good report will distill the information down to a level that is actionable.