The 2016 edition does not prescribe a metric set. It gives a method and 36 worked constructs, including policy review, risk exposure, audit completion, incident cost, training, phishing, password quality, access review, physical entry, maintenance, change, malware, availability, firewall rules, log review, configuration, testing, third parties and incident trends. Each is an example to adapt.
The short answer, expanded
The 2016 edition does not prescribe a metric set. It gives a method and 36 worked constructs, including policy review, risk exposure, audit completion, incident cost, training, phishing, password quality, access review, physical entry, maintenance, change, malware, availability, firewall rules, log review, configuration, testing, third parties and incident trends. Each is an example to adapt.
What to do next
The free check turns this answer into a dated reading for your organization. The register gives you the clause or measure behind the answer. If the question is about a customer or a tender, answer with the requirement standard and the certificate, not with a draft.
Run the free check Open the register
Related questions
Can I copy the examples?
Adapt them. The formula, target, data source and owner should fit your organization.
How many measures should I have?
As many as your information needs require, and no more. Start with the decisions you need to make.
What is a good first measure?
A performance measure that proves the process exists, then an effectiveness measure that shows the result.