The University of SydneyPage 38KGIs, KPIs, CSFsInvestment Optimisation•Security activities achieve strategic objectives on budget•Cost of security proportional to value of asset•Security resources allocated by degree of assessed risk, criticality, and sensitivity•The number of controls to achieve acceptable risk and impact levels