CISOs must create a security strategy built around anticipating outcomes and a feedback loop to gather information during incidents, assessments, threat analysis, and research. The information gathered should then be turned into metrics which will give insights into if the strategy is working, and, if necessary, how to evolve the strategy.

Source: Help Net Security