{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T17:46:02Z","timestamp":1778175962162,"version":"3.51.4"},"reference-count":10,"publisher":"Association for Computing Machinery (ACM)","issue":"10","license":[{"start":{"date-parts":[[2007,10,1]],"date-time":"2007-10-01T00:00:00Z","timestamp":1191196800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2007,10]]},"abstract":"<jats:p>Use measurable, reliable real-world metrics to improve information security decision making.<\/jats:p>","DOI":"10.1145\/1290958.1290969","type":"journal-article","created":{"date-parts":[[2007,9,26]],"date-time":"2007-09-26T17:18:32Z","timestamp":1190827112000},"page":"101-106","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":23,"title":["Necessary measures"],"prefix":"10.1145","volume":"50","author":[{"given":"Wade H.","family":"Baker","sequence":"first","affiliation":[{"name":"Virginia Tech, Blacksburg, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Loren Paul","family":"Rees","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peter S.","family":"Tippett","sequence":"additional","affiliation":[{"name":"Verizon Business, Ashburn, VA and ICSA Labs, Mechanicsburg, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2007,10]]},"reference":[{"key":"e_1_2_1_1_1","first-page":"2","article-title":"The state of information security 2003","volume":"17","author":"Berinato S","year":"2003","unstructured":"Berinato , S . The state of information security 2003 . CIO Magazine 17 , 2 ( Oct. 15, 2003 ). Berinato, S. The state of information security 2003. CIO Magazine 17, 2 (Oct. 15, 2003).","journal-title":"CIO Magazine"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1080\/10864415.2004.11044320"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1005817.1005828"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.32.5.554"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/581271.581274"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the INFORMS Conference on Information Systems and Technology","author":"Jaisingh J.","year":"2001","unstructured":"Jaisingh , J. and Rees , J . Value at risk: A methodology for information security risk assessment . In Proceedings of the INFORMS Conference on Information Systems and Technology ( Miami, Nov. 3--4 , 2001 ). Jaisingh, J. and Rees, J. Value at risk: A methodology for information security risk assessment. In Proceedings of the INFORMS Conference on Information Systems and Technology (Miami, Nov. 3--4, 2001)."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.2307\/249551"},{"key":"e_1_2_1_9_1","volume-title":"MD","author":"Swanson M.","year":"2003","unstructured":"Swanson , M. , Bartol , N. , Sabato , J. , and Graffo , L . Security Metrics Guide for Information Technology Systems. National Institute of Standards and Technology Special Publication 800-55, Gaithersburg , MD , July 2003 . Swanson, M., Bartol, N., Sabato, J., and Graffo, L. Security Metrics Guide for Information Technology Systems. National Institute of Standards and Technology Special Publication 800-55, Gaithersburg, MD, July 2003."},{"key":"e_1_2_1_10_1","volume-title":"Computerworld (Sept. 20","author":"Verton D.","year":"2004","unstructured":"Verton , D. DHS seeks real-world data on security breaches . Computerworld (Sept. 20 , 2004 ). Verton, D. DHS seeks real-world data on security breaches. Computerworld (Sept. 20, 2004)."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/859670.859675"}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1290958.1290969","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1290958.1290969","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:52:25Z","timestamp":1750258345000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1290958.1290969"}},"subtitle":["metric-driven information security risk assessment and decision making"],"short-title":[],"issued":{"date-parts":[[2007,10]]},"references-count":10,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2007,10]]}},"alternative-id":["10.1145\/1290958.1290969"],"URL":"https:\/\/doi.org\/10.1145\/1290958.1290969","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"value":"0001-0782","type":"print"},{"value":"1557-7317","type":"electronic"}],"subject":[],"published":{"date-parts":[[2007,10]]},"assertion":[{"value":"2007-10-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}