A First Literature Pass for Project 002

I finished a first literature pass for Project 002. It was targeted, not systematic; a logged database search comes next.

The closest existing model I found is Gartner's outcome-driven metrics and protection-level agreements, reviewed through public summaries only. That model sets forward-looking protection targets agreed with executives. My framework looks back at value delivered and confirmed by the people who benefit. I think the two complement each other, so I added that as a third design proposition (P3). It is a proposition to test in the comparative analysis, not a conclusion.

P2, that the binding constraint is translation and validation rather than measurement technique, has evidence on both sides. A 2025 Gartner note describes leading organizations relying on qualitative narratives with limited metrics. Hubbard and Seiersen, in How to Measure Anything in Cybersecurity Risk (2023), argue that better quantitative measurement is the most needed fix.

I found no source that tests beneficiary validation (P1) directly. That is the gap this project can claim, and it means P1 rests on argument for now.

The framework is now at v0.5.