KPI

What is a KPI?

A KPI (Key Performance Indicator) is a measurable value that shows to what extent an organisation, process or system is achieving a predefined objective. Where an ordinary measurement only describes what is happening, a KPI is tied to a goal, a target and an owner: it tells you whether you are on track and who has to act if you are not. In an IT/OT environment, KPIs range from machine level, such as the OEE of a production line, to board level, such as the percentage of critical systems patched within the agreed timeframe.

KPIs help to steer, evaluate and improve performance at operational, tactical and strategic levels.

🎯 Why do you use KPIs?

• Insight - the performance of teams, processes or installations becomes visible and comparable
• Monitoring - you track progress towards goals instead of finding out afterwards that they were missed
• An objective basis - adjustment and decision-making rest on data rather than gut feeling
• Transparency - within and between departments it is clear what good performance means
• Continuous improvement - KPIs form the Check step of the PDCA cycle and the measure phase in Lean and Six Sigma

For OT convergence, KPIs serve an extra purpose: they give IT and OT a shared language. A plant manager thinks in availability and output, a security officer in incidents and vulnerabilities. A KPI that connects the two, such as unplanned downtime caused by cyber incidents, makes the conversation concrete.

🧠 What is the difference between a KPI, a PI, a metric and a KRI?

Not every measurement is a KPI. The word key means the indicator says something directly about an objective that matters.

A second important distinction is between leading and lagging indicators. A lagging KPI measures the outcome, such as the number of breakdowns last month. A leading KPI measures a cause that predicts the outcome, such as the percentage of preventive maintenance orders completed. A good set combines both: lagging KPIs show whether you hit the goal, leading KPIs give you time to adjust.

📊 Which KPIs are used in IT and OT environments?

Production KPIs are the most standardised. ISO 22400 (Key performance indicators for manufacturing operations management) fixes formulas and definitions: part 1 (2014) covers concepts and terminology, part 2 (2014) defines 34 KPIs with formula, unit and time behaviour, including OEE, and a 2017 amendment adds KPIs for energy management. The standard aligns with the levels of ISA-95: most KPIs belong at level 3, where MES and MOMS turn data from process control into performance figures. For process control, ISA-18.2 regards an average of about one alarm per ten minutes per operator as very likely acceptable and two per ten minutes as the maximum manageable.

🧮 What makes a good KPI?

The best-known test is SMART. George T. Doran introduced the acronym in November 1981 in the journal Management Review, originally meaning Specific, Measurable, Assignable, Realistic, Time-related. Later variants replaced letters with Achievable, Acceptable or Relevant. A common reading today is:

• Specific - the KPI measures exactly what matters, for one clearly defined process or system
• Measurable - objective and quantifiable, with a fixed formula and data source
• Achievable - ambitious yet attainable with the resources available
• Relevant - linked to an objective the organisation actually cares about
• Time-bound - tied to a period or deadline

In practice three further requirements apply. A KPI has a single owner who can act on it. It can be influenced by that owner, otherwise it only causes frustration. And it is hard to game: once a measure becomes a target, people are tempted to improve the number instead of the process (Goodhart’s law). A maintenance department judged only on MTTR may, for example, start splitting breakdowns or logging them late.

🏭 How do you measure KPIs in an OT environment?

In OT, the raw data comes from PLCs, sensors and the SCADA system. That data flows through a historian or time series database to MES, dashboards in tools such as Grafana and reports in the ERP. Increasingly this runs through a Unified Namespace, in which each figure is calculated once and then used by every consumer. That way production and finance no longer each report their own, slightly different OEE.

Worked example. A packaging line runs five 8-hour shifts in a week: 2,400 minutes of planned production time. There are 240 minutes of unplanned downtime, so availability is 2,160 / 2,400 = 90%. With an ideal cycle time of 1 second per product, the line could have made 129,600 units in 2,160 minutes; it made 116,640, a performance of 90%. Of those, 113,140 are good, a quality rate of 97%. OEE is 0.90 × 0.90 × 0.97 ≈ 78.6%. The same breakdown data yields the maintenance figures: 12 breakdowns with a total repair time of 240 minutes gives an MTTR of 20 minutes.

The quality of the source data determines the value of every KPI. Common pitfalls:

• Unclear downtime reasons - if operators do not record the reason, downtime ends up as “other” and you do not know what to improve
• Wrong ideal cycle time - a generous standard inflates the performance KPI
• Manual spreadsheets - counts are retyped, edited and cannot be traced back to the source
• Clock drift - timestamps from different systems diverge, so events cannot be correlated

🔐 Which KPIs do you use for OT security?

Cybersecurity is steered with KPIs too, and that is no longer optional: NIS2 requires management bodies to approve the cybersecurity risk-management measures and oversee their implementation, and in the Netherlands the Cybersecurity Act (in force since 15 August 2026) transposes this. A board can only exercise oversight if it receives measurable information.

To set up such a measurement programme, NIST published a revised SP 800-55 in two volumes in December 2024: volume 1 on identifying and selecting measures, volume 2 on building a measurement programme. For a management system based on ISO 27001, ISO/IEC 27004 describes how to measure the effectiveness of information security. In OT, patch compliance needs a caveat: many installations cannot be patched straight away, so it is better to measure whether a vulnerability was remediated or demonstrably mitigated within the timeframe, for example through vulnerability management and segmentation.

🔧 How do you build a KPI set?

1. Start with the objective - first state what the organisation wants to achieve, for example 10% less unplanned downtime or demonstrable compliance with the Cybersecurity Act
2. Choose few KPIs - five to ten per level is workable; a dashboard with fifty figures steers nothing
3. Fix the definition - formula, unit, data source, measurement frequency and owner per KPI, for production preferably following ISO 22400
4. Set a baseline and a target - without a starting point improvement cannot be shown; for energy, ISO 50006 describes energy performance indicators (EnPIs) and the energy baseline
5. Automate collection - pull data directly from MES, CMMS or SIEM instead of from manual lists
6. Review and adjust - tie the KPIs to a fixed meeting, from the daily shop-floor huddle to the quarterly board report
7. Evaluate the set - drop KPIs that no longer drive decisions and add new ones when objectives change

A widely used framework for balancing KPIs across the whole organisation is the Balanced Scorecard by Robert Kaplan and David Norton (1992). It combines four perspectives, financial, customer, internal processes, and learning and growth, so that cost savings do not come at the expense of quality or safety.

❓ Frequently asked questions

How many KPIs should an organisation have?

An organisation works best with a small number of KPIs per level, usually five to ten. Too many KPIs scatter attention and make it unclear what really matters. Supporting metrics can still exist underneath without being called KPIs.

What is the difference between a KPI and an OKR?

A KPI continuously measures how well a process or organisation performs against a target. An OKR (Objectives and Key Results) is a method for setting ambitious goals for a specific period, with measurable key results as evidence. A KPI can serve as a key result, but KPIs remain in place even when no improvement goal is running.

Is OEE a KPI?

OEE (Overall Equipment Effectiveness) is one of the best-known production KPIs and is defined in ISO 22400-2. The KPI combines availability, performance and quality into a single percentage. In the TPM tradition, an OEE of 85% is regarded as world class for discrete manufacturing with long runs.

What is a leading KPI?

A leading KPI is an indicator that predicts a future outcome, such as the percentage of preventive maintenance completed on time. A lagging KPI measures the outcome afterwards, such as the number of breakdowns. Leading KPIs give you time to adjust before a goal is missed.

Which KPIs suit OT security?

Useful KPIs for OT security include asset inventory coverage, the percentage of critical vulnerabilities remediated or mitigated on time, and the mean time to detect and respond to incidents. NIST SP 800-55 and ISO/IEC 27004 help you select and define such measures. Under NIS2, management bodies use these KPIs to oversee cybersecurity risk management.

Where does the data for production KPIs come from?

The data for production KPIs comes from PLCs, sensors and SCADA systems and is stored in a historian or time series database. MES or MOM software calculates figures such as OEE, cycle time and first pass yield from it. Additional data on orders and inventory comes from the ERP system.

📌 In summary

KPIs are measurable, goal-linked steering instruments that make performance visible and enable targeted improvement. With clear definitions based on ISO 22400, a good mix of leading and lagging indicators, reliable data from OT systems and a single owner per KPI, they provide focus and continuous improvement in every domain, from production and asset management to risk management and Cybersecurity.