Business owners, leaders, and senior managers are busy. They are dealing with a lot of competing priorities, their time is valuable (a scarce resource in fact!) and more often than not, are under the impression that you already have their security covered.

It is the MSPs job to help their clients understand their cybersecurity quickly and at a level that facilitates quick, data-driven decisions.

In practical terms, this means being:

Thankfully, it's not as difficult as it sounds. Many a professional has trodden this path before in different industries and have proven that time and time again, Key Performance Indicators (KPIs) are the best way to achieve these goals.

HighGround uses 3 KPIs to communicate an organisations cybersecurity posture to their customers.

By simplifying complex cybersecurity data into easy-to-understand KPIs, HighGround empowers MSP owners, account managers, engineers to discuss their clients security posture with confidence, safe in the knowledge that business owners, leaders and senior managers in their clients will understand, engage in conversations and feel empowered to invest in security improvements they actually understand.

This article breaks down each of the 3 KPIs into more detail.

The CyberScore KPI provides a high-level rating of an organization's cybersecurity posture, expressed as a score from 0 to 100.

This score helps organizations understand their current risk level and provides a simple benchmark for comparison over time.

Think of the CyberScore like a credit score for cybersecurity. Just as a credit score reflects financial reliability, CyberScore reflects how well an organization has implemented security controls to protect itself from cyber threats.

An organizations CyberScore is driven by the security technologies and practices an organisation has implemented to protect, detect, respond to and recover from a cyber-attack. Each technology and practice has their own unique weighting that reflects their overall effectiveness in protecting an organisation from cyber-attack.

Technology: something you have a tool for, for example Endpoint Protection.

Practice: sometime you setup, configure and monitor, for example SPF and DKIM, or something you do regularly, for example Penetration Testing.

Almost all of these technologies and practices are included in the NIST Cybersecurity Framework 2.0 and thus represent international best practices. There are a handful of exceptions which are not included in the framework, but which are widely considered best practice and thus have been added to the CyberScore scoring algorithm.

To drive an organizations CyberScore KPI, you must attest to each of the questions on the list, after which the CyberScore will dynamically score.

You can attest an organizations CyberScore by clicking on the CyberScore KPI anywhere in the UI, and attesting to each of the 16 sections and 11 subsections.

When attesting a clients CyberScore, there 2 different types of questions:

​Attesting technologies: you can define the tool that the client uses in your MSPs security stack, or a tool purchased directly by the client., for example 'Sentinel One' as a tool for the 'Endpoint Protection' technology.

Attesting practices: you can define whether a practice is followed / implemented, for example setting up SPF, DKIM and DMARC, or performing annual Penetration Testing.

There are 3 different methods for attesting a clients CyberScore, which you can mix and match together to quickly and accurately map your clients CyberScore:

Method 1 - Manually

Click on each row in the CyberScore attestation modal and select a tool from your MSPs security stack, one of the tools from the general tools list provided by HighGround, or manually creating a tool. For practices, simply add the practices that are implemented.

Method 2 - Applying a security package

The CyberScore can also be driven by applying one of your MSPs security packages to a client. If a security package has been applied to a client, attestation will be locked as it is inherited directly from the security package.

Method 3 - Security Tool Suggestions

If you are unsure of what security tools a client has and you have integrated your PSA or finance tool to HighGround, click the blue 'Review' button for security tool suggestions.

CyberResilience measures an organization’s ability to govern cybersecurity risks, respond to threats, recover from incidents, and learn from cyber-attacks to ensure continual improvement.

While the CyberScore KPI indicated an organizations overall security posture at a given moment, the Cyber Resilience KPI indicates how resilient an organization will be in the event of a cyber-attack.

Just as a healthy immune system fights off infections and builds resistance to future illnesses, a strong Cyber Resilience score means an organization can identify risks ad well as detect, respond to and recover from cyber-attacks without with minimal impact on business operations.

An organizations Cyber Resilience KPI is ultimately a reflection of their ability to manage and govern their cyber risk, which is driven by the security practices they implement and how frequently these are reviewed and testing.

To maintain good Cyber Resilience, and thus a strong Cyber Resilience KPI, organizations must ensure they:

Each security practice has their own unique weighting that reflects their overall effectiveness in ensuring cyber resilience.

Almost all of these security practices are included in the NIST Cybersecurity Framework 2.0 and thus represent international best practices. There are a handful of exceptions which are not included in the framework, but which are widely considered best practice and thus have been added to the Cyber Resilience KPI scoring algorithm.

You can attest an organizations Cyber Resilience by either:

When attesting a clients Cyber Resilience KPI, you attest to security practice. A security practice (in the context of Cyber Resilience) is:

​Practice: sometime you do implement and review regularly, for example Incident Response Plan Reviews, IT Disaster Recovery Tests or Annual Security Presentations with the Board.

There are 2 different methods for attesting a clients Cyber Resilience KPI, which you can mix and match together to quickly and accurately map your clients Cyber Resilience:

Method 1 - Manually

Click on each row in the Cyber Resilience attestation modal and attest to the various questions:

Method 2 - Manage through the Governance & Resilience module

HighGround has a Governance & Resilience module which enables MSPs and their clients to co-manage their cyber resilience activities. Some of the activities you can perform in this module include:

Any activity performed in the Governance & Resilience module will be combined with any attestations to create the Cyber Resilience KPI. Any actual data inputted will override any attestations performed on the Cyber Resilience KPI.

The NIST Cybersecurity Framework (CSF) 2.0 is an industry-standard security model comprising six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
​

HighGround's NIST CSF 2.0 Alignment KPI visually represents how an organization performs across five of these functions using a radar chart (excluding Govern, for which we use the Cyber Resilience KPI).

Hence we often refer to this as the 'Cyber Radar Chart' !

Imagine a fitness tracker that measures different aspects of health, such as heart rate, steps taken, and sleep quality. Similarly, the Cyber Radar Chart shows an organizations cybersecurity maturity against each of the key areas of the framework.

The further an organization extends outward on the chart, the more mature they are in that area.

When using the Cyber Radar Chart with clients, you can refer to their 'security shape' due to the distinctive shape an organization security shape will generate on the Radar Chart.

The KPI assesses cybersecurity maturity across five core functions:

Each function is scored based on attestation responses to the CyberScore and Cyber Resilience KPIs in HighGround, and the results are plotted on a radar chart to provide a clear visual representation.

The NIST CSF 2.0 radar chart cannot be attested to manually - it is inferred from the attestations made on the CyberScore and Cyber Resilience KPIs or by security packages applied to the client.

HighGround’s Cyber KPIs provide a clear, actionable, and data-driven approach to cybersecurity assessment for MSPs and their clients.

By attesting and monitoring their CyberScore, CyberResilience, and NIST CSF 2.0 Alignment, organizations can:

By regularly attesting to security controls within HighGround, organizations can maintain an accurate, up-to-date view of their cybersecurity status and make informed decisions to enhance their resilience against evolving threats.