KPI and KRI Management
KPI and KRI Management is the DigitalXForce module that builds a configurable indicator matrix by business domain, risk category and risk type, with thresholds and Level 1 and Level 2 posture tracking. Each indicator is approved before it is published, and an executive dashboard shows the trend. The indicators are built from validated control results. A figure on the dashboard leads back to a control, the tool that tested it and the date the evidence was read.
KPI and KRI Management is one of the 15 modules of the DigitalXForce platform, and the 15 modules share one data layer. The risk register, the posture view and the indicators therefore read the same results. A board pack assembled by hand the night before a meeting is accurate as of the night before, which is not when the board meets.
What does KPI and KRI Management do?
The module keeps every indicator in one configurable matrix, organized by business domain, risk category and risk type. Each indicator carries its own thresholds. Risk posture is tracked at Level 1 and Level 2, and an executive dashboard shows the trend. Nothing goes on that dashboard until a person has approved it.
The Automated Board Level Metrics and Report Generator lists what the module gives a reporting team.
- Board metrics are generated from live KPIs and KRIs and are ready to present.
- The dashboards show each trend as a chart.
- Reports follow the metrics the board already tracks, and custom templates match industry or board-specific formats.
- Drill-down capabilities let an executive move from a figure in the report to the control results behind it.
What is the difference between a KPI and a KRI?
A key performance indicator (KPI) reports how a control or a program has performed. A key risk indicator (KRI) shows whether the organization stays inside its risk tolerance. NIST IR 8286 Revision 1, published in December 2025, notes that an audit control looks backward at what already happened. A leading indicator looks forward, and NIST gives rising external reconnaissance activity as one that can warn of an attack before it happens.
KPI and KRI Management holds both kinds in the same matrix. A reader sees how a program performed next to how much exposure it still leaves.
Where does each indicator get its data?
The indicators a board sees in DigitalXForce are built from validated control results, read from the organization’s own tools through 250+ technology integrations. Each control is mapped once across 50+ compliance frameworks. Each input can be traced to the tool it came from, the control it belongs to and the date it was read.
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. A control that fails validation weakens the treatment of the risks it supports. The finding goes next to those risks in the register kept by AI-Powered Enterprise Risk Management (ERM), and KPI and KRI Management tracks the indicators that depend on it. The Continuous Control Assurance page explains how each test decides whether a control still operates as expected.
Each control has its own test frequency, set by how fast its evidence can change. The view behind the indicators updates as each control is retested.
How does a failed control move an indicator?
This is what happens in DigitalXForce when one control fails.
- A test on live evidence records that a control no longer operates as expected, and the failure opens a finding.
- One failed control result reaches the compliance view, the posture view and the risk register at the same time.
- The residual risk in the register rises, the related indicator moves toward its threshold, and the indicator shows when it crosses.
- Cyber risk quantification estimates the exposure in dollars, and X-ROC ranks the finding by quantified business impact, not by a severity label alone.
- Every finding has an owner, a target date and a workflow. Remediation can be tracked in the platform or pushed into the team’s ticketing tool.
- The control is tested again when the fix is marked done, and the finding closes only when the retest passes.
- The board sees the change in its trend, along with the earlier results.
The worked example on the cyber risk to business risk page follows this chain with an illustration, not a customer. A control test finds that multifactor authentication is not enforced on several administrator accounts of a payments platform. The indicator for privileged accounts without multifactor authentication then crosses its threshold. The board later sees the event in its trend, with the estimated exposure and how long the gap stayed open.
Cyber risk quantification (CRQ) quantifies a cyber risk in dollars, giving the financial loss the organization would face if the risk materializes. DigitalXForce uses its own model, built on industry best practices and the data the platform collects. Quantified figures are estimates from a model. They help rank risks and should not be read as accounting figures.
Who sets the thresholds and approves each indicator?
The organization sets every threshold. People set the risk appetite and the tolerances. They approve each indicator and its thresholds, and they choose the treatment for each risk. Any risk that is not treated should be accepted by a named person, with a reason and an expiry date.
NIST IR 8286 Revision 1 describes risk appetite as the amount and type of risk an organization is willing to take in meeting its objectives, and NIST says the organization’s most senior leaders set it. Risk tolerance is narrower: it is the readiness to bear the risk that remains after a response. NIST CSF 2.0 expects both statements to be established, communicated and maintained (GV.RM-02). It also expects cybersecurity risk management to be part of enterprise risk management processes (GV.RM-03).
Enterprise risk management (ERM) is the organization-wide practice of identifying, assessing, treating and monitoring the risks that affect an organization’s objectives, in one view instead of in separate silos. On the ERM module page, risk appetite statements are quantified and tracked against live exposure, with alerts when actuals approach thresholds.
The third-party risk metrics page applies the same thinking to suppliers. Useful leading indicators there include a drop in a supplier’s external posture, drift in controls read from its own systems, slipping service levels and stale evidence. Stale evidence is the quiet one, since a report can age without anyone being told.
How do the indicators reach the board?
XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. XForce GPT writes the board-ready narrative and reports from AI JedAI’s analysis. An analyst reviews AI output before anyone relies on it, and the team reviews reports before they go out.
X-ROC, the XForce Risk Operations Center, provides dashboards for the CISO, the CIO and the board. Those dashboards and KPIs are generated from live data rather than assembled for the meeting. The board cyber risk reporting page pairs six common board questions with the record that answers each one.
The Digital Trust Score is DigitalXForce’s composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. DigitalXForce builds the score from the same tested control results that feed the risk register and the indicators.
What do people still decide?
KPI and KRI Management holds the thresholds that follow from a decision about risk. Senior leadership makes that decision. When an indicator crosses a threshold, the risk owner chooses the response.
What should a buyer ask any vendor about KPIs and KRIs?
A buyer can put these questions to any vendor in a demo, DigitalXForce included. The answers show whether the numbers on an executive dashboard are current and owned.
- Ask the vendor to trace one indicator on the dashboard to its evidence and to the date that evidence was read.
- Ask who approved the indicator and its thresholds, and where that approval is recorded.
- Ask what happens to the indicator when the control behind it fails a test, and who is told.
- Ask whether a fix marked done closes the finding, or whether the control has to pass a retest first.
- Ask whether the indicators, the risk register and the posture view read the same control result.
How can a team see this on its own controls?
The demo is a 30 minute walkthrough on your own frameworks and systems. DigitalXForce replies to every request within 1 business day. The standard proof of value runs for 4 weeks on your systems, with success criteria set with you. Connectors are configured in week 1. The attack surface and External Risk View are set up in week 2. The first assessments run in week 3, and DigitalXForce reviews them with you in week 4. The 4-week proof of value page describes each week.
Questions about KPI and KRI Management
What is KPI and KRI Management?
KPI and KRI Management is the DigitalXForce module that builds a configurable indicator matrix by business domain, risk category and risk type, with thresholds and Level 1 and Level 2 posture tracking. Each indicator is approved before it is published, and an executive dashboard shows the trend. It is one of the 15 DigitalXForce modules.
What is the difference between a KPI and a KRI?
A key performance indicator (KPI) reports how a control or a program has performed. A key risk indicator (KRI) shows whether the organization stays inside its risk tolerance. NIST IR 8286 Revision 1 notes that an audit control looks backward, while a leading indicator can warn of an attack before it happens.
Where does the data for each indicator come from?
The indicators are built from validated control results, read from the organization’s own tools through 250+ technology integrations. Each input can be traced to the tool it came from, the control it belongs to and the date it was read.
Who sets the thresholds for each indicator?
The organization does. No indicator is published until it has been approved. People set the risk appetite and the tolerances, approve each indicator and its thresholds, and choose the treatment for each risk.
What happens when an indicator crosses its threshold?
The finding behind it is ranked in X-ROC by quantified business impact, and it gets an owner, a target date and a workflow. The control is tested again when the fix is marked done, and the finding closes only when the retest passes.
Can an executive trace an indicator back to its evidence?
An executive can. The board report generator has drill-down capabilities, so a reader can move from a figure in the report to the control results behind it. Each input can be traced to the tool it came from, the control it belongs to and the date it was read.
How often do the indicators update?
The indicators update as each control is retested. Each control in DigitalXForce has its own test frequency, set by how fast its evidence can change.
Who writes the board narrative?
XForce GPT writes the board-ready narrative and reports from AI JedAI’s analysis. An analyst reviews AI output before anyone relies on it, and the team reviews reports before they go out.
Related pages
The Automated Board Level Metrics and Report Generator describes the board reporting that draws on these indicators. The board cyber risk reporting page shows what a board asks and which record answers it. The cyber risk to business risk page follows one illustrative control failure from the test to the board. Supplier indicators are covered on the third-party risk metrics page.
The risk register behind the KRIs is kept by AI-Powered Enterprise Risk Management (ERM). How a control result is validated is explained on the Continuous Control Assurance page. Findings are worked in X-ROC, the XForce Risk Operations Center. TRiSCM™, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. The What is TRiSCM page explains the category, and the glossary defines KPI and KRI Management along with the other 14 modules.
What recognition has DigitalXForce received?
DigitalXForce was named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Software 2026 Vendor Assessment (Doc #US53007725, September 2026), and a Leader in the IDC MarketScape: Worldwide Governance, Risk, and Compliance Software Vendor Assessment, 2025.
Sources
- NIST published IR 8286 Revision 1 in December 2025, at https://csrc.nist.gov/pubs/ir/8286/r1/final. DigitalXForce cites it on its cyber risk to business risk and board cyber risk reporting pages.
- NIST published the Cybersecurity Framework (CSF) 2.0 at https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final. The outcomes GV.RM-02 and GV.RM-03 are named on the same DigitalXForce pages.
- Every DigitalXForce statement on this page comes from the Solutions, Products and How It Works pages linked above, as published on October 25, 2026.
A 30 minute walkthrough on your own frameworks shows how DigitalXForce would build your indicators from your own control results.
