Good article and I agree with metrics and a dashboard.

My one issue with article is it states what the CIO should do in regards to security. This further perpetrates the error that the CISO should report to the CIO. CIO do the IT stuff and let the CISO – the security C-suite do their thing.

via A CIO guide to building a dashboard for cybersecurity | Healthcare IT News