This is a question I get all the time, in fact it is the number one question by far.
The purpose of cyber security measurement is severalfold
If you're going to have a fighting chance of being successful then you need to start with 'what is performance?'