19.4 Evaluating Security Programs

Why Security Evaluation Matters

Security programs require continuous measurement and improvement to remain effective. Without proper evaluation frameworks, organizations cannot:

• Justify Security Investments: Demonstrate ROI and value to stakeholders

• Identify Gaps: Find weaknesses before attackers do

• Track Progress: Measure improvement over time

• Optimize Resources: Allocate security budgets effectively

• Meet Compliance: Satisfy regulatory and audit requirements

This section provides practical frameworks for measuring, auditing, and continuously improving security programs using quantitative metrics and qualitative assessments.

---

1. Security Metrics and KPIs

Understanding Security Metrics

Security metrics transform complex security activities into measurable data that stakeholders can understand and act upon. Effective metrics should be:

• Actionable: Lead to specific decisions or improvements

• Relevant: Align with business objectives and risk appetite

• Measurable: Based on quantifiable data

• Timely: Available when needed for decision-making

• Cost-effective: Worth the effort to collect and analyze

Python Implementation: Security Metrics Dashboard

import json
import datetime
from typing import Dict, List, Optional
from dataclasses import dataclass
from enum import Enum

class MetricType(Enum):
    OPERATIONAL = "operational"
    STRATEGIC = "strategic"
    COMPLIANCE = "compliance"
    RISK = "risk"

class MetricTrend(Enum):
    IMPROVING = "improving"
    DECLINING = "declining"
    STABLE = "stable"
    UNKNOWN = "unknown"

@dataclass
class SecurityMetric:
    name: str
    value: float
    target: float
    unit: str
    metric_type: MetricType
    last_updated: datetime.datetime
    trend: MetricTrend = MetricTrend.UNKNOWN
    description: str = ""

class SecurityMetricsManager:
    """
    Comprehensive security metrics tracking and analysis system.
    Manages KPIs across operational, strategic, compliance, and risk domains.
    """

    def __init__(self):
        self.metrics: Dict[str, SecurityMetric] = {}
        self.metric_history: Dict[str, List[Dict]] = {}
        self.thresholds = {
            'critical': 0.2,  # 20% or worse from target
            'warning': 0.1,   # 10% from target
            'good': 0.05      # 5% or better from target
        }

    def add_metric(self, metric: SecurityMetric) -> None:
        """Add or update a security metric."""
        self.metrics[metric.name] = metric

        # Track historical data
        if metric.name not in self.metric_history:
            self.metric_history[metric.name] = []

        self.metric_history[metric.name].append({
            'timestamp': metric.last_updated.isoformat(),
            'value': metric.value,
            'target': metric.target
        })

        # Calculate trend if we have historical data
        if len(self.metric_history[metric.name]) > 1:
            metric.trend = self._calculate_trend(metric.name)

    def _calculate_trend(self, metric_name: str) -> MetricTrend:
        """Calculate trend based on last 3 measurements."""
        history = self.metric_history[metric_name]
        if len(history) < 2:
            return MetricTrend.UNKNOWN

        # Look at last 3 points or all available data
        recent_data = history[-3:]
        values = [point['value'] for point in recent_data]

        # Simple trend calculation
        if len(values) >= 2:
            recent_change = values[-1] - values[0]
            if abs(recent_change) < 0.01:  # Less than 1% change
                return MetricTrend.STABLE
            elif recent_change > 0:
                return MetricTrend.IMPROVING
            else:
                return MetricTrend.DECLINING

        return MetricTrend.UNKNOWN

    def get_metric_status(self, metric_name: str) -> str:
        """Determine if metric is meeting targets."""
        if metric_name not in self.metrics:
            return "unknown"

        metric = self.metrics[metric_name]
        deviation = abs(metric.value - metric.target) / metric.target

        if deviation <= self.thresholds['good']:
            return "excellent"
        elif deviation <= self.thresholds['warning']:
            return "good"
        elif deviation <= self.thresholds['critical']:
            return "warning"
        else:
            return "critical"

    def generate_dashboard(self) -> Dict:
        """Generate executive dashboard view of security metrics."""
        dashboard = {
            'summary': {
                'total_metrics': len(self.metrics),
                'last_updated': datetime.datetime.now().isoformat(),
                'status_breakdown': {
                    'excellent': 0,
                    'good': 0,
                    'warning': 0,
                    'critical': 0
                }
            },
            'metrics_by_type': {},
            'key_indicators': []
        }

        # Categorize metrics
        for metric_name, metric in self.metrics.items():
            status = self.get_metric_status(metric_name)
            dashboard['summary']['status_breakdown'][status] += 1

            metric_type = metric.metric_type.value
            if metric_type not in dashboard['metrics_by_type']:
                dashboard['metrics_by_type'][metric_type] = []

            dashboard['metrics_by_type'][metric_type].append({
                'name': metric.name,
                'value': metric.value,
                'target': metric.target,
                'unit': metric.unit,
                'status': status,
                'trend': metric.trend.value,
                'description': metric.description
            })

        # Identify key indicators needing attention
        critical_metrics = [
            name for name in self.metrics.keys()
            if self.get_metric_status(name) in ['critical', 'warning']
        ]

        dashboard['key_indicators'] = [
            {
                'metric': name,
                'status': self.get_metric_status(name),
                'current_value': self.metrics[name].value,
                'target': self.metrics[name].target,
                'recommendation': self._get_recommendation(name)
            }
            for name in critical_metrics[:5]  # Top 5 issues
        ]

        return dashboard

    def _get_recommendation(self, metric_name: str) -> str:
        """Generate actionable recommendations for metrics."""
        metric = self.metrics[metric_name]
        status = self.get_metric_status(metric_name)

        recommendations = {
            'critical': f"Immediate action required for {metric.name}. "
                       f"Current value {metric.value} is significantly below target {metric.target}.",
            'warning': f"Attention needed for {metric.name}. "
                      f"Consider process improvements to reach target {metric.target}.",
        }

        return recommendations.get(status, "Monitor trending and maintain current performance.")

# Example usage and standard security metrics
def create_standard_security_metrics() -> SecurityMetricsManager:
    """Create a metrics manager with standard security KPIs."""
    manager = SecurityMetricsManager()

    # Operational Metrics
    manager.add_metric(SecurityMetric(
        name="Mean Time to Detect (MTTD)",
        value=2.5,  # hours
        target=1.0,
        unit="hours",
        metric_type=MetricType.OPERATIONAL,
        last_updated=datetime.datetime.now(),
        description="Average time to detect security incidents"
    ))

    manager.add_metric(SecurityMetric(
        name="Mean Time to Respond (MTTR)",
        value=8.0,  # hours
        target=4.0,
        unit="hours",
        metric_type=MetricType.OPERATIONAL,
        last_updated=datetime.datetime.now(),
        description="Average time to respond to and contain incidents"
    ))

    manager.add_metric(SecurityMetric(
        name="Vulnerability Remediation Rate",
        value=85.0,  # percentage
        target=95.0,
        unit="%",
        metric_type=MetricType.OPERATIONAL,
        last_updated=datetime.datetime.now(),
        description="Percentage of vulnerabilities remediated within SLA"
    ))

    # Strategic Metrics
    manager.add_metric(SecurityMetric(
        name="Security Training Completion",
        value=78.0,  # percentage
        target=95.0,
        unit="%",
        metric_type=MetricType.STRATEGIC,
        last_updated=datetime.datetime.now(),
        description="Percentage of employees completing security training"
    ))

    manager.add_metric(SecurityMetric(
        name="Security Budget Utilization",
        value=92.0,  # percentage
        target=90.0,
        unit="%",
        metric_type=MetricType.STRATEGIC,
        last_updated=datetime.datetime.now(),
        description="Percentage of allocated security budget utilized"
    ))

    # Risk Metrics
    manager.add_metric(SecurityMetric(
        name="Overall Risk Score",
        value=7.2,  # scale of 1-10
        target=5.0,
        unit="risk_score",
        metric_type=MetricType.RISK,
        last_updated=datetime.datetime.now(),
        description="Aggregate organizational security risk score"
    ))

    # Compliance Metrics
    manager.add_metric(SecurityMetric(
        name="Compliance Score",
        value=88.0,  # percentage
        target=95.0,
        unit="%",
        metric_type=MetricType.COMPLIANCE,
        last_updated=datetime.datetime.now(),
        description="Overall compliance with security policies and regulations"
    ))

    return manager

# Demonstration
if __name__ == "__main__":
    # Create metrics dashboard
    metrics_manager = create_standard_security_metrics()

    # Generate dashboard
    dashboard = metrics_manager.generate_dashboard()

    print("Security Metrics Dashboard")
    print("=" * 50)
    print(f"Total Metrics: {dashboard['summary']['total_metrics']}")
    print(f"Status Breakdown:")
    for status, count in dashboard['summary']['status_breakdown'].items():
        print(f"  {status.title()}: {count}")

    print("\nKey Indicators Needing Attention:")
    for indicator in dashboard['key_indicators']:
        print(f"- {indicator['metric']}: {indicator['status'].upper()}")
        print(f"  Current: {indicator['current_value']}, Target: {indicator['target']}")
        print(f"  Recommendation: {indicator['recommendation']}\n")

Key Performance Indicators (KPIs)

Operational KPIs:

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Vulnerability remediation rate

• Security incident frequency

• False positive rates

Strategic KPIs:

• Security training completion rates

• Security budget ROI

• Employee security awareness scores

• Third-party risk assessments completed

• Security control coverage

Risk KPIs:

• Overall risk posture score

• Critical vulnerabilities outstanding

• Risk mitigation completion rate

• Business impact of security incidents

• Residual risk levels

Compliance KPIs:

• Audit finding closure rate

• Policy compliance percentage

• Regulatory requirement adherence

• Control effectiveness ratings

• Certification maintenance status

---

2. Risk Assessment Frameworks

Risk Assessment Methodology

Effective risk assessment combines quantitative analysis with qualitative judgment to:

• Identify Assets: Catalog critical business assets and data

• Assess Threats: Evaluate potential attack vectors and threat actors

• Analyze Vulnerabilities: Identify weaknesses in controls and processes

• Calculate Impact: Estimate business consequences of security incidents

• Determine Likelihood: Assess probability of threats materializing

• Prioritize Risks: Rank risks for treatment and resource allocation

Python Implementation: Risk Assessment Framework

import json
import datetime
from typing import Dict, List, Optional, Tuple
from dataclasses import dataclass, field
from enum import Enum

class AssetType(Enum):
    DATA = "data"
    SYSTEM = "system"
    APPLICATION = "application"
    INFRASTRUCTURE = "infrastructure"
    PERSONNEL = "personnel"

class ThreatCategory(Enum):
    MALWARE = "malware"
    INSIDER_THREAT = "insider_threat"
    EXTERNAL_ATTACK = "external_attack"
    NATURAL_DISASTER = "natural_disaster"
    HUMAN_ERROR = "human_error"
    SYSTEM_FAILURE = "system_failure"

class RiskLevel(Enum):
    VERY_LOW = 1
    LOW = 2
    MEDIUM = 3
    HIGH = 4
    VERY_HIGH = 5

@dataclass
class Asset:
    id: str
    name: str
    asset_type: AssetType
    business_value: int  # 1-5 scale
    confidentiality_impact: int  # 1-5 scale
    integrity_impact: int  # 1-5 scale
    availability_impact: int  # 1-5 scale
    description: str = ""
    owner: str = ""

    @property
    def overall_impact(self) -> float:
        """Calculate overall business impact."""
        return (self.confidentiality_impact + 
                self.integrity_impact + 
                self.availability_impact) / 3.0

@dataclass
class Threat:
    id: str
    name: str
    category: ThreatCategory
    likelihood: int  # 1-5 scale
    description: str = ""
    attack_vectors: List[str] = field(default_factory=list)

@dataclass
class Vulnerability:
    id: str
    name: str
    severity: int  # 1-5 scale (CVSS-like)
    exploitability: int  # 1-5 scale
    description: str = ""
    affected_assets: List[str] = field(default_factory=list)
    mitigation_status: str = "open"  # open, in_progress, mitigated

@dataclass
class RiskScenario:
    id: str
    name: str
    asset_id: str
    threat_id: str
    vulnerability_ids: List[str]
    likelihood: float
    impact: float
    risk_score: float
    risk_level: RiskLevel
    description: str = ""
    mitigation_controls: List[str] = field(default_factory=list)

class RiskAssessmentFramework:
    """
    Comprehensive risk assessment framework for security program evaluation.
    Implements quantitative risk analysis with qualitative insights.
    """

    def __init__(self):
        self.assets: Dict[str, Asset] = {}
        self.threats: Dict[str, Threat] = {}
        self.vulnerabilities: Dict[str, Vulnerability] = {}
        self.risk_scenarios: Dict[str, RiskScenario] = {}
        self.risk_tolerance = {
            'very_low': 2.0,
            'low': 4.0,
            'medium': 6.0,
            'high': 8.0,
            'very_high': 10.0
        }

    def add_asset(self, asset: Asset) -> None:
        """Add asset to the risk assessment scope."""
        self.assets[asset.id] = asset

    def add_threat(self, threat: Threat) -> None:
        """Add threat to the threat landscape."""
        self.threats[threat.id] = threat

    def add_vulnerability(self, vulnerability: Vulnerability) -> None:
        """Add vulnerability to the assessment."""
        self.vulnerabilities[vulnerability.id] = vulnerability

    def calculate_risk_scenario(self, asset_id: str, threat_id: str, 
                              vulnerability_ids: List[str]) -> RiskScenario:
        """Calculate risk for a specific threat-asset-vulnerability combination."""
        if asset_id not in self.assets or threat_id not in self.threats:
            raise ValueError("Asset or threat not found")

        asset = self.assets[asset_id]
        threat = self.threats[threat_id]

        # Calculate likelihood (threat likelihood + vulnerability exploitability)
        vuln_factor = 1.0
        if vulnerability_ids:
            vuln_scores = []
            for vuln_id in vulnerability_ids:
                if vuln_id in self.vulnerabilities:
                    vuln = self.vulnerabilities[vuln_id]
                    vuln_scores.append(vuln.exploitability)

            if vuln_scores:
                vuln_factor = max(vuln_scores) / 5.0  # Normalize to 0-1

        likelihood = (threat.likelihood / 5.0) * vuln_factor * 5.0  # Scale back to 1-5

        # Calculate impact (asset business value + CIA impact)
        impact = (asset.business_value + asset.overall_impact) / 2.0

        # Calculate risk score (likelihood × impact)
        risk_score = likelihood * impact

        # Determine risk level
        if risk_score <= 5:
            risk_level = RiskLevel.VERY_LOW
        elif risk_score <= 10:
            risk_level = RiskLevel.LOW
        elif risk_score <= 15:
            risk_level = RiskLevel.MEDIUM
        elif risk_score <= 20:
            risk_level = RiskLevel.HIGH
        else:
            risk_level = RiskLevel.VERY_HIGH

        scenario_id = f"{asset_id}_{threat_id}_{len(self.risk_scenarios)}"

        scenario = RiskScenario(
            id=scenario_id,
            name=f"{asset.name} vs {threat.name}",
            asset_id=asset_id,
            threat_id=threat_id,
            vulnerability_ids=vulnerability_ids,
            likelihood=likelihood,
            impact=impact,
            risk_score=risk_score,
            risk_level=risk_level,
            description=f"Risk of {threat.name} affecting {asset.name}"
        )

        self.risk_scenarios[scenario_id] = scenario
        return scenario

    def generate_risk_register(self) -> Dict:
        """Generate comprehensive risk register for the organization."""
        # Auto-generate risk scenarios for all asset-threat combinations
        for asset_id, asset in self.assets.items():
            for threat_id, threat in self.threats.items():
                # Find relevant vulnerabilities for this asset
                relevant_vulns = [
                    vuln_id for vuln_id, vuln in self.vulnerabilities.items()
                    if asset_id in vuln.affected_assets or not vuln.affected_assets
                ]

                self.calculate_risk_scenario(asset_id, threat_id, relevant_vulns)

        # Analyze risk landscape
        risk_register = {
            'summary': {
                'total_scenarios': len(self.risk_scenarios),
                'risk_distribution': {},
                'top_risks': [],
                'assessment_date': datetime.datetime.now().isoformat()
            },
            'scenarios': [],
            'recommendations': []
        }

        # Calculate risk distribution
        for level in RiskLevel:
            count = sum(1 for scenario in self.risk_scenarios.values() 
                       if scenario.risk_level == level)
            risk_register['summary']['risk_distribution'][level.name] = count

        # Sort scenarios by risk score
        sorted_scenarios = sorted(
            self.risk_scenarios.values(),
            key=lambda x: x.risk_score,
            reverse=True
        )

        # Top 10 risks
        risk_register['summary']['top_risks'] = [
            {
                'id': scenario.id,
                'name': scenario.name,
                'risk_score': round(scenario.risk_score, 2),
                'risk_level': scenario.risk_level.name,
                'asset': self.assets[scenario.asset_id].name,
                'threat': self.threats[scenario.threat_id].name
            }
            for scenario in sorted_scenarios[:10]
        ]

        # Full scenario details
        risk_register['scenarios'] = [
            {
                'id': scenario.id,
                'name': scenario.name,
                'asset': self.assets[scenario.asset_id].name,
                'threat': self.threats[scenario.threat_id].name,
                'likelihood': round(scenario.likelihood, 2),
                'impact': round(scenario.impact, 2),
                'risk_score': round(scenario.risk_score, 2),
                'risk_level': scenario.risk_level.name,
                'description': scenario.description,
                'vulnerabilities': [
                    self.vulnerabilities[vuln_id].name 
                    for vuln_id in scenario.vulnerability_ids
                    if vuln_id in self.vulnerabilities
                ]
            }
            for scenario in sorted_scenarios
        ]

        # Generate recommendations
        risk_register['recommendations'] = self._generate_risk_recommendations(sorted_scenarios)

        return risk_register

    def _generate_risk_recommendations(self, sorted_scenarios: List[RiskScenario]) -> List[Dict]:
        """Generate actionable risk mitigation recommendations."""
        recommendations = []

        # Focus on top 5 highest risks
        for scenario in sorted_scenarios[:5]:
            if scenario.risk_level in [RiskLevel.HIGH, RiskLevel.VERY_HIGH]:
                asset = self.assets[scenario.asset_id]
                threat = self.threats[scenario.threat_id]

                recommendation = {
                    'risk_scenario': scenario.name,
                    'priority': 'High' if scenario.risk_level == RiskLevel.HIGH else 'Critical',
                    'recommended_actions': [],
                    'timeline': '30 days' if scenario.risk_level == RiskLevel.VERY_HIGH else '90 days'
                }

                # Threat-specific recommendations
                if threat.category == ThreatCategory.MALWARE:
                    recommendation['recommended_actions'].extend([
                        'Implement advanced endpoint protection',
                        'Enhance email security filtering',
                        'Conduct malware response training'
                    ])
                elif threat.category == ThreatCategory.EXTERNAL_ATTACK:
                    recommendation['recommended_actions'].extend([
                        'Strengthen perimeter defenses',
                        'Implement network segmentation',
                        'Enhance monitoring and detection'
                    ])
                elif threat.category == ThreatCategory.INSIDER_THREAT:
                    recommendation['recommended_actions'].extend([
                        'Implement user behavior analytics',
                        'Strengthen access controls',
                        'Enhance background checks'
                    ])

                # Asset-specific recommendations
                if asset.asset_type == AssetType.DATA:
                    recommendation['recommended_actions'].extend([
                        'Implement data encryption',
                        'Establish data loss prevention',
                        'Classify and label sensitive data'
                    ])
                elif asset.asset_type == AssetType.SYSTEM:
                    recommendation['recommended_actions'].extend([
                        'Apply security patches promptly',
                        'Harden system configurations',
                        'Implement system monitoring'
                    ])

                recommendations.append(recommendation)

        return recommendations

# Example usage with sample data
def create_sample_risk_assessment() -> RiskAssessmentFramework:
    """Create a sample risk assessment with realistic data."""
    framework = RiskAssessmentFramework()

    # Add sample assets
    framework.add_asset(Asset(
        id="asset_001",
        name="Customer Database",
        asset_type=AssetType.DATA,
        business_value=5,
        confidentiality_impact=5,
        integrity_impact=4,
        availability_impact=3,
        description="Primary customer data repository",
        owner="Data Team"
    ))

    framework.add_asset(Asset(
        id="asset_002", 
        name="Web Application Server",
        asset_type=AssetType.SYSTEM,
        business_value=4,
        confidentiality_impact=3,
        integrity_impact=4,
        availability_impact=5,
        description="Production web server",
        owner="Infrastructure Team"
    ))

    # Add sample threats
    framework.add_threat(Threat(
        id="threat_001",
        name="Advanced Persistent Threat",
        category=ThreatCategory.EXTERNAL_ATTACK,
        likelihood=3,
        description="Sophisticated external attackers targeting sensitive data",
        attack_vectors=["spear phishing", "zero-day exploits", "supply chain attacks"]
    ))

    framework.add_threat(Threat(
        id="threat_002",
        name="Ransomware Attack",
        category=ThreatCategory.MALWARE,
        likelihood=4,
        description="Encrypted systems demanding ransom payment",
        attack_vectors=["email attachments", "drive-by downloads", "remote access"]
    ))

    # Add sample vulnerabilities
    framework.add_vulnerability(Vulnerability(
        id="vuln_001",
        name="Unpatched Web Server",
        severity=4,
        exploitability=3,
        description="Web server missing critical security patches",
        affected_assets=["asset_002"],
        mitigation_status="open"
    ))

    framework.add_vulnerability(Vulnerability(
        id="vuln_002",
        name="Weak Database Encryption", 
        severity=3,
        exploitability=2,
        description="Database using deprecated encryption algorithms",
        affected_assets=["asset_001"],
        mitigation_status="in_progress"
    ))

    return framework

# Demonstration
if __name__ == "__main__":
    # Create and run risk assessment
    risk_framework = create_sample_risk_assessment()
    risk_register = risk_framework.generate_risk_register()

    print("Risk Assessment Results")
    print("=" * 50)
    print(f"Total Risk Scenarios: {risk_register['summary']['total_scenarios']}")

    print("\nRisk Distribution:")
    for level, count in risk_register['summary']['risk_distribution'].items():
        print(f"  {level}: {count}")

    print(f"\nTop 5 Risks:")
    for risk in risk_register['summary']['top_risks'][:5]:
        print(f"- {risk['name']}: {risk['risk_level']} (Score: {risk['risk_score']})")

    print(f"\nRecommendations:")
    for rec in risk_register['recommendations']:
        print(f"- {rec['risk_scenario']} ({rec['priority']} Priority)")
        for action in rec['recommended_actions'][:2]:
            print(f"  • {action}")

Key Performance Indicators (KPIs)

Operational KPIs:

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Vulnerability remediation rate

• Security incident frequency

• False positive rates

Strategic KPIs:

• Security training completion rates

• Security budget ROI

• Employee security awareness scores

• Third-party risk assessments completed

• Security control coverage

Risk KPIs:

• Overall risk posture score

• Critical vulnerabilities outstanding

• Risk mitigation completion rate

• Business impact of security incidents

• Residual risk levels

Compliance KPIs:

• Audit finding closure rate

• Policy compliance percentage

• Regulatory requirement adherence

• Control effectiveness ratings

• Certification maintenance status

---

3. Security Audit Processes

Understanding Security Audits

Security audits provide independent assessment of security programs through systematic evaluation of:

• Control Effectiveness: Whether security controls operate as designed

• Policy Compliance: Adherence to internal policies and procedures

• Regulatory Alignment: Compliance with external requirements

• Risk Management: Adequacy of risk identification and mitigation

• Process Maturity: Sophistication and repeatability of security processes

Python Implementation: Security Audit Management System

import json
import datetime
from typing import Dict, List, Optional, Tuple
from dataclasses import dataclass, field
from enum import Enum

class AuditType(Enum):
    INTERNAL = "internal"
    EXTERNAL = "external"
    REGULATORY = "regulatory"
    THIRD_PARTY = "third_party"

class FindingSeverity(Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"
    INFORMATIONAL = "informational"

class FindingStatus(Enum):
    OPEN = "open"
    IN_PROGRESS = "in_progress"
    RESOLVED = "resolved"
    ACCEPTED = "accepted"
    DEFERRED = "deferred"

class ControlCategory(Enum):
    ACCESS_CONTROL = "access_control"
    NETWORK_SECURITY = "network_security"
    DATA_PROTECTION = "data_protection"
    INCIDENT_RESPONSE = "incident_response"
    BUSINESS_CONTINUITY = "business_continuity"
    RISK_MANAGEMENT = "risk_management"
    COMPLIANCE = "compliance"

@dataclass
class SecurityControl:
    id: str
    name: str
    category: ControlCategory
    description: str
    implementation_status: str  # implemented, partial, not_implemented
    effectiveness_rating: int  # 1-5 scale
    test_results: List[str] = field(default_factory=list)
    evidence: List[str] = field(default_factory=list)
    last_tested: Optional[datetime.datetime] = None

@dataclass
class AuditFinding:
    id: str
    title: str
    severity: FindingSeverity
    status: FindingStatus
    description: str
    affected_controls: List[str]
    remediation_plan: str
    target_date: datetime.datetime
    assigned_to: str
    created_date: datetime.datetime
    closed_date: Optional[datetime.datetime] = None
    verification_evidence: List[str] = field(default_factory=list)

class SecurityAuditManager:
    """
    Comprehensive security audit management system.
    Manages audit planning, execution, findings tracking, and remediation.
    """

    def __init__(self):
        self.controls: Dict[str, SecurityControl] = {}
        self.findings: Dict[str, AuditFinding] = {}
        self.audit_history: List[Dict] = []
        self.remediation_timeline = {
            FindingSeverity.CRITICAL: 7,    # days
            FindingSeverity.HIGH: 30,       # days
            FindingSeverity.MEDIUM: 90,     # days
            FindingSeverity.LOW: 180,       # days
            FindingSeverity.INFORMATIONAL: 365  # days
        }

    def add_security_control(self, control: SecurityControl) -> None:
        """Add security control to audit scope."""
        self.controls[control.id] = control

    def conduct_control_assessment(self, control_id: str, 
                                 test_procedures: List[str],
                                 evidence_collected: List[str]) -> Dict:
        """Assess effectiveness of a security control."""
        if control_id not in self.controls:
            raise ValueError(f"Control {control_id} not found")

        control = self.controls[control_id]
        control.test_results = test_procedures
        control.evidence = evidence_collected
        control.last_tested = datetime.datetime.now()

        # Simple effectiveness assessment based on evidence quality
        evidence_score = min(len(evidence_collected), 5)  # Cap at 5
        implementation_bonus = {
            'implemented': 2,
            'partial': 1,
            'not_implemented': 0
        }.get(control.implementation_status, 0)

        control.effectiveness_rating = min(evidence_score + implementation_bonus, 5)

        assessment_result = {
            'control_id': control_id,
            'control_name': control.name,
            'effectiveness_rating': control.effectiveness_rating,
            'assessment_date': control.last_tested.isoformat(),
            'implementation_status': control.implementation_status,
            'test_procedures_completed': len(test_procedures),
            'evidence_items': len(evidence_collected),
            'recommendations': self._generate_control_recommendations(control)
        }

        return assessment_result

    def _generate_control_recommendations(self, control: SecurityControl) -> List[str]:
        """Generate recommendations for control improvement."""
        recommendations = []

        if control.effectiveness_rating < 3:
            recommendations.append("Consider strengthening control implementation")
            recommendations.append("Review control design for adequacy")

        if control.implementation_status == "partial":
            recommendations.append("Complete full implementation of control")
        elif control.implementation_status == "not_implemented":
            recommendations.append("Implement control to address identified risks")

        if len(control.evidence) < 3:
            recommendations.append("Gather additional evidence to support control testing")

        if not control.last_tested or (datetime.datetime.now() - control.last_tested).days > 365:
            recommendations.append("Conduct regular testing of control effectiveness")

        return recommendations

    def create_audit_finding(self, title: str, severity: FindingSeverity,
                           description: str, affected_controls: List[str],
                           assigned_to: str) -> AuditFinding:
        """Create new audit finding with automatic remediation timeline."""
        finding_id = f"finding_{len(self.findings) + 1:04d}"

        # Calculate target remediation date based on severity
        days_to_remediate = self.remediation_timeline[severity]
        target_date = datetime.datetime.now() + datetime.timedelta(days=days_to_remediate)

        finding = AuditFinding(
            id=finding_id,
            title=title,
            severity=severity,
            status=FindingStatus.OPEN,
            description=description,
            affected_controls=affected_controls,
            remediation_plan="",  # To be filled by assigned person
            target_date=target_date,
            assigned_to=assigned_to,
            created_date=datetime.datetime.now()
        )

        self.findings[finding_id] = finding
        return finding

    def update_finding_status(self, finding_id: str, new_status: FindingStatus,
                            evidence: List[str] = None) -> None:
        """Update finding status with optional verification evidence."""
        if finding_id not in self.findings:
            raise ValueError(f"Finding {finding_id} not found")

        finding = self.findings[finding_id]
        finding.status = new_status

        if evidence:
            finding.verification_evidence.extend(evidence)

        if new_status == FindingStatus.RESOLVED:
            finding.closed_date = datetime.datetime.now()

    def generate_audit_report(self, audit_type: AuditType) -> Dict:
        """Generate comprehensive audit report."""
        report = {
            'audit_metadata': {
                'audit_type': audit_type.value,
                'report_date': datetime.datetime.now().isoformat(),
                'scope': f"{len(self.controls)} security controls assessed",
                'duration': "4 weeks",  # Example duration
                'auditor': "Security Team"
            },
            'executive_summary': {},
            'control_assessment': {},
            'findings_summary': {},
            'recommendations': [],
            'appendices': {
                'detailed_findings': [],
                'control_test_results': []
            }
        }

        # Executive Summary
        total_controls = len(self.controls)
        effective_controls = sum(1 for c in self.controls.values() if c.effectiveness_rating >= 3)

        open_findings = sum(1 for f in self.findings.values() if f.status == FindingStatus.OPEN)
        critical_findings = sum(1 for f in self.findings.values() 
                              if f.severity == FindingSeverity.CRITICAL and f.status == FindingStatus.OPEN)

        report['executive_summary'] = {
            'overall_security_posture': 'Good' if (effective_controls / total_controls) > 0.8 else 'Needs Improvement',
            'controls_assessed': total_controls,
            'effective_controls': effective_controls,
            'control_effectiveness_rate': round((effective_controls / total_controls) * 100, 1),
            'total_findings': len(self.findings),
            'open_findings': open_findings,
            'critical_findings': critical_findings,
            'key_observations': self._generate_key_observations()
        }

        # Control Assessment Summary
        control_summary = {}
        for category in ControlCategory:
            category_controls = [c for c in self.controls.values() if c.category == category]
            if category_controls:
                avg_effectiveness = sum(c.effectiveness_rating for c in category_controls) / len(category_controls)
                control_summary[category.value] = {
                    'total_controls': len(category_controls),
                    'average_effectiveness': round(avg_effectiveness, 1),
                    'status': 'Effective' if avg_effectiveness >= 3 else 'Needs Improvement'
                }

        report['control_assessment'] = control_summary

        # Findings Summary
        findings_by_severity = {}
        for severity in FindingSeverity:
            severity_findings = [f for f in self.findings.values() if f.severity == severity]
            findings_by_severity[severity.value] = {
                'total': len(severity_findings),
                'open': sum(1 for f in severity_findings if f.status == FindingStatus.OPEN),
                'overdue': sum(1 for f in severity_findings 
                             if f.status == FindingStatus.OPEN and f.target_date < datetime.datetime.now())
            }

        report['findings_summary'] = findings_by_severity

        # Top Recommendations
        report['recommendations'] = self._generate_top_recommendations()

        # Detailed findings for appendix
        for finding in sorted(self.findings.values(), key=lambda x: x.severity.value, reverse=True):
            report['appendices']['detailed_findings'].append({
                'id': finding.id,
                'title': finding.title,
                'severity': finding.severity.value,
                'status': finding.status.value,
                'description': finding.description,
                'affected_controls': finding.affected_controls,
                'target_date': finding.target_date.isoformat(),
                'assigned_to': finding.assigned_to,
                'days_until_due': (finding.target_date - datetime.datetime.now()).days
            })

        # Control test results for appendix
        for control in self.controls.values():
            report['appendices']['control_test_results'].append({
                'id': control.id,
                'name': control.name,
                'category': control.category.value,
                'effectiveness_rating': control.effectiveness_rating,
                'implementation_status': control.implementation_status,
                'last_tested': control.last_tested.isoformat() if control.last_tested else None,
                'test_procedures': len(control.test_results),
                'evidence_items': len(control.evidence)
            })

        return report

    def _generate_key_observations(self) -> List[str]:
        """Generate key observations for executive summary."""
        observations = []

        # Control effectiveness observation
        total_controls = len(self.controls)
        effective_controls = sum(1 for c in self.controls.values() if c.effectiveness_rating >= 3)
        effectiveness_rate = (effective_controls / total_controls) * 100

        if effectiveness_rate >= 90:
            observations.append("Security controls demonstrate strong effectiveness across all categories")
        elif effectiveness_rate >= 75:
            observations.append("Most security controls are effective with room for improvement in specific areas")
        else:
            observations.append("Significant gaps identified in security control effectiveness")

        # Findings observation
        critical_findings = sum(1 for f in self.findings.values() 
                              if f.severity == FindingSeverity.CRITICAL and f.status == FindingStatus.OPEN)
        if critical_findings > 0:
            observations.append(f"{critical_findings} critical findings require immediate attention")

        # Implementation status observation
        unimplemented = sum(1 for c in self.controls.values() 
                          if c.implementation_status == "not_implemented")
        if unimplemented > 0:
            observations.append(f"{unimplemented} security controls remain unimplemented")

        return observations

    def _generate_top_recommendations(self) -> List[Dict]:
        """Generate top priority recommendations."""
        recommendations = []

        # Critical findings first
        critical_findings = [f for f in self.findings.values() 
                           if f.severity == FindingSeverity.CRITICAL and f.status == FindingStatus.OPEN]

        for finding in critical_findings[:3]:  # Top 3 critical
            recommendations.append({
                'priority': 'Critical',
                'recommendation': f"Address critical finding: {finding.title}",
                'timeline': '7 days',
                'business_impact': 'High risk to business operations and data security'
            })

        # Control improvements
        weak_controls = [c for c in self.controls.values() if c.effectiveness_rating < 3]
        if weak_controls:
            recommendations.append({
                'priority': 'High',
                'recommendation': f"Strengthen {len(weak_controls)} underperforming security controls",
                'timeline': '30 days',
                'business_impact': 'Reduced security posture and increased risk exposure'
            })

        # Implementation gaps
        unimplemented = [c for c in self.controls.values() 
                        if c.implementation_status == "not_implemented"]
        if unimplemented:
            recommendations.append({
                'priority': 'Medium',
                'recommendation': f"Implement {len(unimplemented)} missing security controls",
                'timeline': '90 days',
                'business_impact': 'Compliance gaps and potential security vulnerabilities'
            })

        return recommendations

---

5. Communicating Security Value to Executives

Understanding Executive Perspectives

Executives evaluate security through business lenses, focusing on:

• Risk Management: How security reduces business risks

• ROI and Value: Financial returns on security investments

• Compliance: Meeting regulatory and legal requirements

• Competitive Advantage: Security as business differentiator

• Operational Impact: Effects on business operations and productivity

Python Implementation: Executive Communication Framework

import json
import datetime
from typing import Dict, List, Optional, Tuple
from dataclasses import dataclass, field
from enum import Enum

class PresentationAudience(Enum):
    CEO = "ceo"
    CFO = "cfo"
    CTO = "cto"
    BOARD = "board"
    SENIOR_MANAGEMENT = "senior_management"

class MetricRelevance(Enum):
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"

@dataclass
class ExecutiveMetric:
    name: str
    current_value: float
    target_value: float
    trend: str  # improving, declining, stable
    business_impact: str
    relevance_by_audience: Dict[PresentationAudience, MetricRelevance]
    narrative: str
    supporting_data: List[str] = field(default_factory=list)

@dataclass
class SecurityStory:
    title: str
    audience: PresentationAudience
    key_message: str
    supporting_metrics: List[str]
    business_context: str
    call_to_action: str
    risk_without_action: str
    expected_outcomes: List[str]

class ExecutiveCommunicationFramework:
    """
    Framework for communicating security value and performance to executives.
    Translates technical metrics into business language and impact.
    """

    def __init__(self):
        self.executive_metrics: Dict[str, ExecutiveMetric] = {}
        self.presentation_templates: Dict[PresentationAudience, Dict] = {}
        self.success_stories: List[Dict] = []
        self.business_cases: List[Dict] = []
        self._initialize_templates()

    def _initialize_templates(self):
        """Initialize presentation templates for different executive audiences."""
        self.presentation_templates = {
            PresentationAudience.CEO: {
                'focus_areas': ['Business risk reduction', 'Competitive advantage', 'Customer trust'],
                'preferred_metrics': ['Risk reduction %', 'Customer retention', 'Revenue protection'],
                'time_horizon': 'Strategic (1-3 years)',
                'communication_style': 'High-level, outcome-focused',
                'key_concerns': ['Business continuity', 'Reputation protection', 'Growth enablement']
            },
            PresentationAudience.CFO: {
                'focus_areas': ['ROI and cost management', 'Risk mitigation', 'Compliance costs'],
                'preferred_metrics': ['Security ROI', 'Cost per incident', 'Budget efficiency'],
                'time_horizon': 'Financial cycles (quarterly/annual)',
                'communication_style': 'Quantitative, cost-benefit focused',
                'key_concerns': ['Budget optimization', 'Financial risk', 'Audit readiness']
            },
            PresentationAudience.CTO: {
                'focus_areas': ['Technical effectiveness', 'Innovation enablement', 'Operational efficiency'],
                'preferred_metrics': ['System availability', 'Deployment velocity', 'Technical debt'],
                'time_horizon': 'Technical roadmap (6-18 months)',
                'communication_style': 'Technical depth with business context',
                'key_concerns': ['Technology strategy', 'Development velocity', 'Infrastructure security']
            },
            PresentationAudience.BOARD: {
                'focus_areas': ['Governance and oversight', 'Strategic risk', 'Stakeholder confidence'],
                'preferred_metrics': ['Risk posture', 'Compliance status', 'Board resolution tracking'],
                'time_horizon': 'Governance cycles (quarterly)',
                'communication_style': 'Governance-focused, risk-aware',
                'key_concerns': ['Fiduciary responsibility', 'Regulatory compliance', 'Stakeholder trust']
            }
        }

    def add_executive_metric(self, metric: ExecutiveMetric) -> None:
        """Add metric optimized for executive reporting."""
        self.executive_metrics[metric.name] = metric

    def generate_executive_dashboard(self, audience: PresentationAudience) -> Dict:
        """Generate audience-specific executive dashboard."""
        template = self.presentation_templates[audience]

        # Filter metrics by relevance to audience
        relevant_metrics = [
            (name, metric) for name, metric in self.executive_metrics.items()
            if metric.relevance_by_audience.get(audience, MetricRelevance.LOW) in [MetricRelevance.HIGH, MetricRelevance.MEDIUM]
        ]

        # Sort by relevance
        relevant_metrics.sort(key=lambda x: x[1].relevance_by_audience[audience].value, reverse=True)

        dashboard = {
            'audience_profile': {
                'target_audience': audience.value,
                'focus_areas': template['focus_areas'],
                'communication_style': template['communication_style'],
                'key_concerns': template['key_concerns']
            },
            'executive_summary': self._generate_executive_summary(audience, relevant_metrics),
            'key_metrics': [
                {
                    'name': metric.name,
                    'current_value': metric.current_value,
                    'target_value': metric.target_value,
                    'trend': metric.trend,
                    'business_impact': metric.business_impact,
                    'narrative': metric.narrative,
                    'relevance': metric.relevance_by_audience[audience].value
                }
                for name, metric in relevant_metrics[:6]  # Top 6 metrics
            ],
            'success_highlights': self._get_success_stories(audience),
            'investment_recommendations': self._generate_investment_recommendations(audience),
            'risk_overview': self._generate_risk_overview(audience)
        }

        return dashboard

    def _generate_executive_summary(self, audience: PresentationAudience, metrics: List[Tuple]) -> str:
        """Generate audience-appropriate executive summary."""
        if not metrics:
            return "Security metrics dashboard - comprehensive view of security program performance."

        # Analyze metric trends
        improving_metrics = sum(1 for _, metric in metrics if metric.trend == "improving")
        total_metrics = len(metrics)

        # Audience-specific messaging
        if audience == PresentationAudience.CEO:
            summary = f"Security program demonstrates strong business value with {improving_metrics}/{total_metrics} key metrics improving. "
            summary += "Security investments continue to reduce business risks while enabling growth initiatives and maintaining customer trust."

        elif audience == PresentationAudience.CFO:
            total_value = sum(metric.current_value for _, metric in metrics if 'cost' not in metric.name.lower())
            summary = f"Security program delivers measurable ROI with {improving_metrics}/{total_metrics} performance indicators trending positively. "
            summary += f"Current security investments show strong cost-benefit ratio and risk mitigation value."

        elif audience == PresentationAudience.CTO:
            summary = f"Security program maintains high technical effectiveness with {improving_metrics}/{total_metrics} operational metrics improving. "
            summary += "Security controls integrate well with development processes and support technical innovation goals."

        elif audience == PresentationAudience.BOARD:
            summary = f"Security governance demonstrates effective oversight with {improving_metrics}/{total_metrics} strategic metrics on positive trajectory. "
            summary += "Risk management practices align with board directives and regulatory requirements."

        else:
            summary = f"Security program performance shows {improving_metrics}/{total_metrics} key indicators improving, "
            summary += "demonstrating effective risk management and business value delivery."

        return summary

    def _get_success_stories(self, audience: PresentationAudience) -> List[Dict]:
        """Get audience-relevant success stories."""
        # Filter success stories by audience interests
        audience_interests = self.presentation_templates[audience]['focus_areas']

        relevant_stories = []
        for story in self.success_stories:
            # Simple relevance matching
            story_relevance = 0
            story_text = (story.get('title', '') + ' ' + story.get('description', '')).lower()

            for interest in audience_interests:
                if any(keyword in story_text for keyword in interest.lower().split()):
                    story_relevance += 1

            if story_relevance > 0:
                relevant_stories.append({
                    'title': story['title'],
                    'description': story['description'],
                    'business_impact': story['business_impact'],
                    'relevance_score': story_relevance
                })

        # Sort by relevance and return top 3
        relevant_stories.sort(key=lambda x: x['relevance_score'], reverse=True)
        return relevant_stories[:3]

    def _generate_investment_recommendations(self, audience: PresentationAudience) -> List[Dict]:
        """Generate audience-specific investment recommendations."""
        recommendations = []

        if audience == PresentationAudience.CEO:
            recommendations = [
                {
                    'title': 'Strategic Security Investment',
                    'description': 'Expand security capabilities to support business growth and market expansion',
                    'business_case': 'Enable new market entry while maintaining customer trust and regulatory compliance',
                    'investment_range': '$500K - $1M',
                    'expected_roi': 'Risk reduction + growth enablement',
                    'timeline': '12-18 months'
                }
            ]

        elif audience == PresentationAudience.CFO:
            recommendations = [
                {
                    'title': 'Security Automation Investment',
                    'description': 'Implement automated security tools to reduce operational costs',
                    'business_case': 'Reduce manual security operations costs by 40% while improving effectiveness',
                    'investment_range': '$200K - $400K',
                    'expected_roi': '300% over 3 years',
                    'timeline': '6-9 months'
                }
            ]

        elif audience == PresentationAudience.CTO:
            recommendations = [
                {
                    'title': 'DevSecOps Platform Investment',
                    'description': 'Integrate security into development pipeline for faster, secure delivery',
                    'business_case': 'Maintain development velocity while improving security quality',
                    'investment_range': '$150K - $300K',
                    'expected_roi': 'Faster delivery + reduced vulnerabilities',
                    'timeline': '3-6 months'
                }
            ]

        elif audience == PresentationAudience.BOARD:
            recommendations = [
                {
                    'title': 'Governance and Risk Platform',
                    'description': 'Comprehensive risk management and compliance tracking system',
                    'business_case': 'Ensure regulatory compliance and provide board-level risk visibility',
                    'investment_range': '$300K - $600K',
                    'expected_roi': 'Compliance assurance + risk transparency',
                    'timeline': '9-12 months'
                }
            ]

        return recommendations

    def _generate_risk_overview(self, audience: PresentationAudience) -> Dict:
        """Generate audience-appropriate risk overview."""
        risk_overview = {
            'current_risk_level': 'Medium',
            'trend': 'Improving',
            'key_risks': [],
            'mitigation_status': 'On Track'
        }

        if audience == PresentationAudience.CEO:
            risk_overview['key_risks'] = [
                'Business disruption from cyber attacks',
                'Customer data breach impacting trust',
                'Competitive disadvantage from security gaps'
            ]
            risk_overview['business_context'] = 'Risks managed to enable business growth while protecting core assets'

        elif audience == PresentationAudience.CFO:
            risk_overview['key_risks'] = [
                'Financial losses from security incidents',
                'Regulatory fines and compliance costs',
                'Insurance premium increases'
            ]
            risk_overview['business_context'] = 'Risk mitigation strategies provide strong ROI and cost predictability'

        elif audience == PresentationAudience.CTO:
            risk_overview['key_risks'] = [
                'System vulnerabilities and technical debt',
                'Development pipeline security gaps',
                'Infrastructure security weaknesses'
            ]
            risk_overview['business_context'] = 'Technical risks managed through integrated security practices'

        elif audience == PresentationAudience.BOARD:
            risk_overview['key_risks'] = [
                'Regulatory compliance failures',
                'Fiduciary responsibility gaps',
                'Stakeholder confidence impacts'
            ]
            risk_overview['business_context'] = 'Governance frameworks ensure oversight and accountability'

        return risk_overview

    def create_security_story(self, title: str, audience: PresentationAudience,
                            key_message: str, business_context: str,
                            supporting_metrics: List[str], call_to_action: str,
                            risk_without_action: str, expected_outcomes: List[str]) -> SecurityStory:
        """Create compelling security narrative for executives."""
        story = SecurityStory(
            title=title,
            audience=audience,
            key_message=key_message,
            supporting_metrics=supporting_metrics,
            business_context=business_context,
            call_to_action=call_to_action,
            risk_without_action=risk_without_action,
            expected_outcomes=expected_outcomes
        )

        return story

    def generate_presentation_outline(self, audience: PresentationAudience, story: SecurityStory) -> Dict:
        """Generate presentation outline tailored to audience and story."""
        template = self.presentation_templates[audience]

        outline = {
            'presentation_title': story.title,
            'target_audience': audience.value,
            'duration': '15-20 minutes',
            'slides': [
                {
                    'slide_number': 1,
                    'title': 'Executive Summary',
                    'content': story.key_message,
                    'speaker_notes': f"Frame the message in context of {template['key_concerns'][0]}"
                },
                {
                    'slide_number': 2,
                    'title': 'Business Context',
                    'content': story.business_context,
                    'speaker_notes': f"Connect to audience interests: {', '.join(template['focus_areas'])}"
                },
                {
                    'slide_number': 3,
                    'title': 'Supporting Evidence',
                    'content': f"Key metrics: {', '.join(story.supporting_metrics)}",
                    'speaker_notes': f"Present data in {template['communication_style']} style"
                },
                {
                    'slide_number': 4,
                    'title': 'Risk and Opportunity',
                    'content': f"Risk without action: {story.risk_without_action}",
                    'speaker_notes': "Emphasize business consequences of inaction"
                },
                {
                    'slide_number': 5,
                    'title': 'Recommended Action',
                    'content': story.call_to_action,
                    'speaker_notes': "Present clear, specific next steps"
                },
                {
                    'slide_number': 6,
                    'title': 'Expected Outcomes',
                    'content': f"Success will deliver: {', '.join(story.expected_outcomes)}",
                    'speaker_notes': f"Align outcomes with {template['time_horizon']} expectations"
                }
            ],
            'appendix': {
                'detailed_metrics': 'Available upon request',
                'technical_details': 'Available for follow-up discussion',
                'implementation_timeline': 'Detailed project plan available'
            }
        }

        return outline

# Example usage and demonstration
def create_sample_executive_communication():
    """Create sample executive communication framework."""
    framework = ExecutiveCommunicationFramework()

    # Add executive-friendly metrics
    framework.add_executive_metric(ExecutiveMetric(
        name="Security ROI",
        current_value=285.0,  # percentage
        target_value=300.0,
        trend="improving",
        business_impact="Every $1 invested in security returns $2.85 in risk reduction and operational efficiency",
        relevance_by_audience={
            PresentationAudience.CEO: MetricRelevance.HIGH,
            PresentationAudience.CFO: MetricRelevance.HIGH,
            PresentationAudience.CTO: MetricRelevance.MEDIUM,
            PresentationAudience.BOARD: MetricRelevance.MEDIUM
        },
        narrative="Security investments continue to deliver strong returns through reduced incident costs and improved operational efficiency.",
        supporting_data=["Incident cost reduction: 45%", "Operational efficiency gains: 25%", "Compliance cost savings: 30%"]
    ))

    framework.add_executive_metric(ExecutiveMetric(
        name="Customer Trust Score",
        current_value=8.7,  # out of 10
        target_value=9.0,
        trend="stable",
        business_impact="Strong security posture maintains customer confidence and supports revenue growth",
        relevance_by_audience={
            PresentationAudience.CEO: MetricRelevance.HIGH,
            PresentationAudience.CFO: MetricRelevance.MEDIUM,
            PresentationAudience.CTO: MetricRelevance.LOW,
            PresentationAudience.BOARD: MetricRelevance.HIGH
        },
        narrative="Customer trust in our security practices remains high, supporting continued business growth and market expansion.",
        supporting_data=["Customer retention: 94%", "Security-related complaints: <1%", "Trust survey scores: 8.7/10"]
    ))

    # Add success story
    framework.success_stories.append({
        'title': 'Zero-Day Vulnerability Response',
        'description': 'Rapid response to critical zero-day vulnerability prevented potential data breach',
        'business_impact': 'Avoided estimated $2.5M in breach costs and reputation damage',
        'timeline': 'Detected and mitigated within 4 hours',
        'stakeholder_feedback': 'Board commended security team for exemplary response'
    })

    return framework

# Demonstration
if __name__ == "__main__":
    # Create executive communication framework
    comm_framework = create_sample_executive_communication()

    # Generate CEO dashboard
    ceo_dashboard = comm_framework.generate_executive_dashboard(PresentationAudience.CEO)

    print("CEO Security Dashboard")
    print("=" * 50)
    print(f"Executive Summary: {ceo_dashboard['executive_summary']}")
    print(f"\nKey Metrics:")
    for metric in ceo_dashboard['key_metrics']:
        print(f"- {metric['name']}: {metric['current_value']} (Target: {metric['target_value']}) - {metric['trend']}")

    print(f"\nInvestment Recommendations:")
    for rec in ceo_dashboard['investment_recommendations']:
        print(f"- {rec['title']}: {rec['business_case']}")
        print(f"  Investment: {rec['investment_range']}, ROI: {rec['expected_roi']}")

    # Create security story
    story = comm_framework.create_security_story(
        title="Strategic Security Investment for Market Expansion",
        audience=PresentationAudience.CEO,
        key_message="Strategic security investments will enable safe expansion into new markets while maintaining customer trust",
        business_context="Market expansion requires enhanced security to meet new regulatory requirements and customer expectations",
        supporting_metrics=["Security ROI: 285%", "Customer Trust: 8.7/10", "Compliance Rate: 98%"],
        call_to_action="Approve $750K security investment to support Q3 market expansion",
        risk_without_action="Market expansion delayed 6-12 months due to security gaps, losing competitive advantage",
        expected_outcomes=["Secure market entry", "Maintained customer trust", "Regulatory compliance", "Competitive advantage"]
    )

    # Generate presentation outline
    presentation = comm_framework.generate_presentation_outline(PresentationAudience.CEO, story)

    print(f"\n\nPresentation Outline: {presentation['presentation_title']}")
    print(f"Target Audience: {presentation['target_audience']}")
    print(f"Duration: {presentation['duration']}")

    for slide in presentation['slides']:
        print(f"\nSlide {slide['slide_number']}: {slide['title']}")
        print(f"Content: {slide['content']}")

---

Recap and Key Takeaways

Security program evaluation requires a comprehensive approach combining quantitative metrics, qualitative assessments, and effective communication:

Essential Evaluation Components

1. Security Metrics and KPIs: Operational, strategic, risk, and compliance indicators that provide measurable insights into program performance

2. Risk Assessment Frameworks: Systematic approaches to identifying, analyzing, and prioritizing security risks across the organization

3. Security Audit Processes: Independent evaluation of control effectiveness, compliance status, and process maturity

4. Continuous Improvement Methodologies: Structured approaches to advancing security program maturity and capabilities

5. Executive Communication: Business-focused reporting that translates security metrics into business value and risk insights

Best Practices for Security Evaluation

• Balance Metrics: Combine leading and lagging indicators across multiple domains

• Automate Data Collection: Reduce manual effort and improve accuracy of measurements

• Regular Assessment Cycles: Conduct evaluations on predictable schedules aligned with business cycles

• Stakeholder Engagement: Involve business stakeholders in defining success criteria and evaluation frameworks

• Continuous Learning: Use evaluation results to drive program improvements and strategic decisions

Success Factors

Effective security program evaluation depends on:

• Clear Objectives: Well-defined goals for what the security program should achieve

• Appropriate Metrics: Measurements that align with business objectives and risk tolerance

• Regular Monitoring: Consistent tracking and reporting of key performance indicators

• Action-Oriented Analysis: Focus on actionable insights that drive improvement decisions

• Executive Support: Leadership engagement and commitment to acting on evaluation results

Security evaluation is not a one-time activity but an ongoing process that enables organizations to demonstrate value, identify improvements, and maintain effective security postures in evolving threat landscapes.