The multifaceted aspects of security programs become clearer with the creation and collection of appropriate metrics.