Note: metric
measures the level of protection against a misuse vulnerability within the local IT environment and captures both how widespread mitigation implementation is and how effective such mitigation is.
Source(s):
NISTIR 7864