The purpose of cyber security measurement is severalfold
If you're going to have a fighting chance of being successful then you need to start with 'what is performance?'
