How should leaders measure whether inclusion efforts are working?

Why This Matters for Security Teams

Inclusion measurement is often treated as a reporting exercise, but it is really an operating signal. If leaders only count headcount, they can miss whether women and other underrepresented groups are advancing into the roles where influence, technical depth, and decision-making actually happen. That gap matters because representation at the top is usually shaped by promotion pathways, access to stretch work, and retention, not just hiring.

The same logic appears in identity governance: visibility alone does not prove control. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which is a useful reminder that surface metrics can look healthy while the underlying system remains weak. For leaders, a credible inclusion programme should show movement across the whole lifecycle, not only at the point of entry. The NIST Cybersecurity Framework 2.0 uses the same principle in governance terms: measure outcomes, not just policy existence.

In practice, many organisations discover stalled advancement only after exit interviews, pay reviews, or team composition audits reveal the pattern, rather than through intentional measurement.

How It Works in Practice

Leaders should measure inclusion as a funnel, not a single point-in-time count. That means tracking who is hired, who stays, who is promoted, who gets access to high-visibility projects, and who receives the sponsorship that leads to advancement. Good measurement also separates representation by level, function, and location, because an organisation can look balanced in entry roles while remaining uneven in technical leadership.

A useful operating model is to combine quantitative and qualitative measures. Quantitative indicators show whether the system is moving: hiring mix, retention by demographic group, promotion velocity, compensation bands, and participation in key work. Qualitative indicators explain why the numbers are moving or stalling: employee pulse surveys, exit themes, manager behaviour, and access to development opportunities. Current guidance suggests that leaders should compare outcomes over time rather than relying on a single annual snapshot.

• Track retention and promotion separately, since strong hiring can hide weak advancement.
• Review access to training, mentoring, and technical leadership assignments.
• Measure participation in high-visibility work, not just committee representation.
• Break results down by level so early pipeline gains do not mask senior-level stagnation.

This is similar to NHI governance, where the Ultimate Guide to NHIs highlights how excessive privilege and poor lifecycle controls create risk even when assets are technically “covered.” For inclusion, the equivalent risk is assuming the programme works because hiring numbers improved. The NIST Cybersecurity Framework 2.0 supports a similar discipline: define outcomes, assign owners, measure regularly, and use the results to adjust controls and accountability.

These measures tend to break down when managers are rewarded only for headcount growth, because that incentive structure can increase hiring without improving progression or retention.

Common Variations and Edge Cases

Tighter measurement often increases management overhead, requiring organisations to balance analytical depth against survey fatigue, reporting burden, and privacy expectations. That tradeoff matters because inclusion metrics can become counterproductive if teams believe they are being watched without seeing any change in decision-making.

There is no universal standard for this yet, but best practice is evolving toward outcome-based measurement with careful segmentation. Smaller organisations may not have enough sample size for every demographic slice, so they should focus on trend direction and qualitative evidence rather than over-interpreting small numbers. In regulated or highly distributed environments, leaders may also need to separate local team performance from enterprise-wide results, since one strong manager can mask a weaker broader system.

One practical warning is that improved representation in hiring can be misleading if women are concentrated in support functions while technical and leadership tracks remain unchanged. That is why promotion rates, access to stretch work, and pay progression are usually better indicators than hiring alone. The NHI lesson is again useful here: the Ultimate Guide to NHIs shows how hidden gaps matter more than visible counts, and the NIST Cybersecurity Framework 2.0 reinforces the need to measure whether controls are actually improving outcomes.

Where leadership teams cannot link measurement to promotion decisions, the programme becomes a dashboard, not a governance mechanism.

Related resources from NHI Mgmt Group

• How can organisations know whether their Azure AD governance is working?
• How can organisations tell whether credential management is actually working?
• How can teams tell whether identity controls are working in a remote workforce?
• How do auditors evaluate whether SOX segregation of duties is working?