Getting and using metrics for CISO's can be challenging, from either not enough information or too much information, knowing what to get and how to use it is important.