# PM-6 — Measures of Performance

- **Control ID:** PM-6
- **Family:** [PM](/md/families/PM.md)
- **Baselines:** No content available.
- **Enhancement of:** No content available.

## Description

Develop, monitor, and report on the results of information security and privacy measures of performance.

## Discussion

Measures of performance are outcome-based metrics used by an organization to measure the effectiveness or efficiency of the information security and privacy programs and the controls employed in support of the program. To facilitate security and privacy risk management, organizations consider aligning measures of performance with the organizational risk tolerance as defined in the risk management strategy.

## Implementation guidance

No content available.

## CSF 2.0 subcategories

- [GV.OV-03](/md/csf/GV.OV-03.md) — Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed

## Related controls

- [CA-7](/md/controls/CA-7.md)
- [PM-9](/md/controls/PM-9.md)

---

Derived from official NIST publications (NIST SP 800-53 Rev 5 and NIST CSF 2.0). nistcontrols.com is not affiliated with NIST.