Firms at the intermediate phase of cybersecurity and privacy maturity begin to measure everything. With the right metrics in place in areas such policy effectiveness and employee skills development, CIOs can initiate a virtuous circle of perpetual learning and refinement. This report — the second of three in the people competency of the cybersecurity and privacy playbook — helps CIOs meet the challenges of the intermediate phase. This is an update of a previously published report; Forrester reviews and updates it periodically for continued relevance and accuracy.