CISO Governance Metrics: Incidents Prevented, Approval Time, Coverage

```yaml
version: 1.3
owners:
  security: alex.lee@company.com
  privacy: nora.singh@company.com
  audit: internal.audit@company.com
regions:
  - id: us
    data_residency: aws-us-east-1
  - id: eu
    data_residency: aws-eu-central-1
rbac:
  roles:
    - name: approver
      permissions: [read_kpi, approve_requests, view_logs]
    - name: analyst
      permissions: [read_kpi, view_logs]
    - name: auditor
      permissions: [read_kpi, view_logs, export_evidence]
privacy:
  prompt_logging: required
  pii_redaction: inline
  retain_audit_trail_days: 2555   # 7 years
  never_train_on_client_data: true
metrics:
  incidents_prevented:
    definition: "Blocked events that would have violated policy if executed"
    baseline_incident_rate: 0.18    # prior-year rate for similar events
    sampling:
      method: stratified_random
      sample_rate: 0.1
      confidence_level: 0.9
    severity_weights: {low: 0.5, medium: 1, high: 2}
    threshold:
      min_prevented_per_quarter: 120
    evidence_sources:
      - waf.alerts
      - dlp.block_events
      - ai_proxy.denied_requests
      - servicenow.change_rejections
  approval_cycle_time:
    definition: "P95 time from intake to decision"
    slo:
      standard_p95_days: 5
      urgent_p95_hours: 24
    routing_rules:
      high_risk: [security, privacy, data_owner]
      standard: [security]
    escalation:
      breach_action: page #sec‑oncall, notify GC
      auto_report: weekly to audit@company.com
    evidence_sources:
      - servicenow.requests
      - jira.issues
  usage_coverage:
    definition: "governed_sessions / total_sessions"
    targets:
      q1: 0.9
      q2: 0.95
    evidence_sources:
      - okta.signin_events
      - casb.discovery
      - api_gateway.access_logs
      - ai_proxy.sessions
  prompt_logging_coverage:
    definition: "% of AI interactions with prompts/outputs logged"
    target: 1.0
    exceptions_require: DPIA
workflows:
  approval_flow:
    intake_system: ServiceNow
    forms: [ai_use_request_v2, data_sharing_addendum]
    approvers:
      - role: security
        sla_days: 2
      - role: privacy
        sla_days: 2
      - role: data_owner
        sla_days: 1
    change_freeze_threshold:
      consecutive_slo_breaches: 3
      action: require_exception_committee
observability:
  dashboards:
    - name: governance_scorecard
      refresh: hourly
      owners: [alex.lee@company.com, nora.singh@company.com]
  alerts:
    - metric: approval_cycle_time.p95
      condition: "> 5 days"
      channels: ["slack:#sec‑oncall", "email:gc@company.com"]
    - metric: usage_coverage
      condition: "< 0.9"
      channels: ["slack:#ai‑program", "email:it.ops@company.com"]
```

{
  "title": "CISO Governance Metrics: Incidents Prevented, Approval Time, Coverage",
  "published_date": "2025-11-27",
  "author": {
    "name": "Michael Thompson",
    "role": "Head of Governance",
    "entity": "DeepSpeed AI"
  },
  "core_concept": "AI Governance and Compliance",
  "key_takeaways": [
    "Define three core KPIs: incidents prevented, approval cycle time, and governed usage coverage.",
    "Instrument a trust layer that logs prompts, approvals, and lineage with RBAC and data residency.",
    "Use control-group baselines to estimate prevented incidents credibly for board and audit.",
    "Cut approval cycle time by standardizing templates and automated risk routing in ServiceNow/Jira.",
    "Reach 90%+ governed usage by unifying SSO, CASB, and proxy logs into your metric layer."
  ],
  "faq": [
    {
      "question": "How do we estimate incidents prevented without over‑claiming?",
      "answer": "Use prior‑year incident rates for comparable events, apply conservative severity weights, and validate via stratified sampling with Legal sign‑off. Publish a confidence score and document the method."
    },
    {
      "question": "What if our approval process is decentralized?",
      "answer": "Standardize the intake form and route via ServiceNow/Jira. Keep regional approvers but enforce consistent SLOs and evidence requirements across queues."
    },
    {
      "question": "How do we reach 90%+ governed usage?",
      "answer": "Proxy high‑traffic AI interfaces, integrate SSO, CASB, and API gateways, and block unknown egress. Publish BU‑level coverage with owners and remediation dates."
    }
  ],
  "business_impact_evidence": {
    "organization_profile": "Global retail bank, 40k employees, multi‑region (US/EU), regulated under GDPR and OCC.",
    "before_state": "Approvals P95 at 9 business days; 54% coverage; no formal incidents prevented metric; two open audit findings.",
    "after_state": "Approvals P95 at 4.9 business days in pilot; 93% governed usage coverage; 168 prevented incidents (confidence 0.88); closed audit findings.",
    "metrics": [
      "45% faster approvals in pilot BU (P95).",
      "93% governed usage coverage (up from 54%).",
      "168 incidents prevented with 0.88 confidence.",
      "2 audit findings closed with evidence pipeline."
    ],
    "governance": "Legal/Security approved due to prompt logging with RBAC, regional data residency (EU/US), immutable decision ledgers, human‑in‑the‑loop for high‑risk, and a guarantee that models never train on client data."
  },
  "summary": "A CISO playbook to quantify AI governance with incidents prevented, approval cycle time, and usage coverage—implemented in 30 days with audit-ready evidence."
}