<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-security-okr-frameworks
description: >-
  Design and implement OKR (Objectives and Key Results) frameworks tailored
  for security organizations that translate strategic goals into measurable
  outcomes, align team efforts, and demonstrate security value to leadership.
domain: cybersecurity
subdomain: security-leadership
tags:
  - okr
  - metrics
  - kpi
  - security-measurement
  - goal-setting
  - performance-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Security OKR Frameworks

## Overview

Security OKR frameworks translate broad security goals into measurable key
results. Well-designed OKRs align security teams with business objectives,
create accountability, and provide evidence of security program value.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Security program strategy | Strategic objectives to decompose |
| Measurement infrastructure | Data sources for tracking key results |
| Stakeholder alignment | Business leadership buy-in on objectives |
| Cadence commitment | Quarterly review and scoring cycle |

## Key Concepts

- **Objective**: Qualitative, aspirational goal (what to achieve)
- **Key Result**: Quantitative, measurable outcome (how to measure)
- **Stretch targets**: Set key results at 70% expected achievement
- **Cascade alignment**: Team OKRs roll up to organizational objectives
- **Scoring**: 0.0–1.0 scale per key result, 0.7 is target

## Workflow

### Step 1: Define Security Objectives

```python
SECURITY_OKRS = {
    "objective_1": {
        "objective": "Achieve world-class threat detection capability",
        "key_results": [
            {"kr": "Reduce MTTD from 48h to 4h", "metric": "mttd_hours", "target": 4},
            {"kr": "Increase detection coverage to 80% of ATT&CK", "metric": "coverage_pct", "target": 80},
            {"kr": "Reduce false positive rate below 10%", "metric": "fp_rate_pct", "target": 10},
        ],
    },
    "objective_2": {
        "objective": "Build a resilient security organization",
        "key_results": [
            {"kr": "Hire 3 senior detection engineers", "metric": "headcount", "target": 3},
            {"kr": "Achieve team eNPS > 40", "metric": "enps_score", "target": 40},
            {"kr": "Complete 100% of training plans", "metric": "training_pct", "target": 100},
        ],
    },
}
```

### Step 2: Implement Measurement

```python
def score_key_result(current: float, target: float, baseline: float) -> float:
    """Score a key result on 0.0-1.0 scale."""
    if target == baseline:
        return 1.0 if current == target else 0.0
    progress = (current - baseline) / (target - baseline)
    return max(0.0, min(1.0, progress))

def score_objective(key_results: list[dict]) -> float:
    """Average score across all key results for an objective."""
    scores = [
        score_key_result(kr["current"], kr["target"], kr["baseline"])
        for kr in key_results
    ]
    return sum(scores) / len(scores) if scores else 0.0
```

### Step 3: Track and Review

```bash
node agent.js score --quarter Q2-2026 --team detection-engineering
node agent.js report --quarter Q2-2026 --format executive
node agent.js align --parent-okrs company_okrs.json --team-okrs security_okrs.json
```

## Verification

| Check | Method |
|---|---|
| All objectives have 3-5 key results | OKR structure validation |
| Key results are measurable | Each has a numeric target |
| Alignment verified | Team OKRs map to org objectives |
| Scoring cadence active | Quarterly reviews scheduled |

## References

- [Measure What Matters — John Doerr](https://www.whatmatters.com/)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [SANS Security Metrics](https://www.sans.org/)
