When establishing metrics for reporting to the information security strategy committee, the most important consideration is aligning the metrics with the organizational culture. This ensures that the metrics are relevant, meaningful, and likely to be supported and understood by organizational members, including senior management. Metrics that align with the organizational culture are more likely to be adopted, tracked, and acted upon effectively. Benchmarking, baselines, and dashboards are all important but are secondary considerations that depend on the initial alignment with the organizational culture.