In order to have a successful IG program, one of the eight (8) Information Risk Planning and Management steps is to develop metrics and measure results.   From your required readings, discuss the value that metrics brings to the organization, and identify critical measures of success that should be tracked.