The University of SydneyPage 36KGIs, KPIs, CSFsRisk Management•Cost effectiveness--Costs of efforts vs outcomes of risk assessment•Trends for adverse impacts continuously improving--Trend of reduction in open vulnerabilities--Trend of improved detection and responses to new risk--Improving policy compliance--Increasing security awareness--Improved results of BCP / DR tests