OSMS turns security KPIs into reproducible decision contracts: every number carries its formula, denominator, data confidence, evidence pointer and the decision it triggers. No green without proof.
"How quickly do we detect incidents on critical assets?"
“Where does this 94 % actually come from?”
The board waits. Somewhere between three exports and a pivot table, the answer died. You promise to follow up — and everyone hears what that means.
Day one of the audit. Three teams, three definitions of “coverage”.
Three different truths. Every number renegotiated from zero, every threshold defended from memory. The findings write themselves.
The dashboard was green all quarter. The incident came anyway.
Because green measured activity, not reality: no denominator, no evidence pointer, no one accountable for the number itself.
OSMS turns every security metric into one: a formula with a defended denominator, an evidence pointer, a confidence gate and a named decision — auditable from the board slide down to the raw record. That’s what the four principles below enforce.
The Open Security Metrics Standard defines how a security metric must be specified so that any board member, auditor or engineer can trust it — and anyone can recompute it from the raw records.
Most security KPIs cannot survive an audit. Definitions live in slide decks, denominators shift between reports, exceptions are removed silently, and dashboards show green without a single pointer to evidence. Boards end up steering risk on numbers nobody can reproduce.
OSMS principle 01: no metric without a decision. If a number does not prepare or trigger a decision, it has no place in the report.
Each of the 327 cards fixes the full contract of one metric: the formula with named inputs, numerator and denominator, scope and as-of date, the minimum data fields every record must carry (evidence reference, record ID, source system), rebuild steps an auditor can follow, and a drilldown lineage from the board value back to the raw record.
Every card declares its data confidence across five components — completeness, freshness, source authority, consistency and reconciliation quality. Below the confidence gate there is no green; an empty denominator yields n/a, never 0. Thresholds are not styling decisions: they are versioned risk-appetite statements with a documented decision chain when a gate is breached.
The catalog spans 39 domains — from SOC operations, detection engineering and vulnerability management to AI governance, resilience and third-party risk — typed as KPI, KRI, KCI, outcome, confidence and maturity indicators, with framework mappings to NIST CSF, DORA and NIS2 where they apply. Specification and catalog are CC BY 4.0, the tooling is MIT: clone the repository, run the validator, and re-run any number we publish.
Free foundation material from the OSMS Academy — share it with your team, your board, or your auditor.
The primer: terms, principles, card anatomy, RAG logic and the data-confidence gate — 21 slides that explain the standard to anyone.
The doing package: a step-by-step starter guide plus an XLSX working file to plan and track your first reporting wave.
Updated with each release — get a short mail when a new edition ships.
# Don't take our word for it — re-run the contract:
$ git clone https://github.com/OpenSecurityMetricsStandard/OSMS
$ pip install pyyaml jsonschema
$ python tools/osms_validate.py catalog/ \
--schema schema/osms-card.schema.json
cards: 327 | errors: 0 | result: PASS
The validator enforces the card schema plus 16 semantic rules — ID uniqueness, rollup-cycle detection, threshold/direction consistency, evidence fields, confidence gates. The same checks run on every pull request. Schema: osms-card.schema.json
Findings are triaged within five working days, decided by an independent review board, and the review itself is measured against published KPIs — a metrics standard should expect nothing less. Every accepted, rejected and deferred finding is logged publicly.
Reviewers are credited by name in the specification and the forthcoming book, get preview access to the first OSMS-native platform, and shape the v1.1 backlog. The Review Board itself is curated and invite-only.
OSMS is the open standard. The book is the official guide. The platform is one implementation — never a prerequisite.
The specification and catalog stay free under CC BY 4.0. The German-language guide to OSMS 1.0 ships after the freeze; a reference platform demonstrates the standard end-to-end. None of them changes what the standard says.
Releases and review milestones today — and what comes next: the book, the KPI platform, and the academy. Short mails, only when something is ready. No noise.