Information security metrics provide organizations with effective instruments to prioritize data exposure threats and vulnerabilities, as well their associated potential risks for enterprise information assets.Security metrics should be prioritized and use both quantitative and qualitative data.