A control needs an objective

An installed tool is the beginning of the measurement, not its result.

State the promised behavior

A control objective describes what a safeguard should achieve within a defined scope. Installation demonstrates presence. Effectiveness requires evidence that the intended behavior occurs under the relevant conditions. A useful objective names the population, required result, time limit, and responsible role.

Assume a fictional support team requires every scheduled exercise event to reach its monitoring queue within five minutes and receive an owner’s acknowledgment within fifteen minutes of the event. This example measures the complete workflow during staffed hours, not detection accuracy against real attacks.

Supplied exercise results

• M1: Twelve eligible events were generated during staffed hours; all reached the queue eventually.
• M2: Ten arrived within five minutes. Two arrived after nine minutes.
• M3: Of the ten timely alerts, eight received acknowledgment within fifteen minutes of the event. Two did not.

Work through the denominator

Eight of twelve cases meet both requirements: about 66.7%. Ten of twelve meet delivery alone. Twelve of twelve eventually arriving is a useful reliability observation, but it does not meet the time-bound objective. Removing late alerts from the denominator would hide a workflow failure.

Assign investigation of the two delivery delays and the two acknowledgment misses. Preserve their individual timestamps so the team can distinguish collection delay from queue ownership problems. Acknowledgment also does not prove that an incident was correctly resolved.

Model conclusion: The exercise met the complete objective in 8/12 cases. Improve the four misses and repeat a comparable exercise before claiming better coverage.