How should we measure success in compliance?

Measure what the business feels. Track sales cycle time, questionnaire pass rate, pipeline unlocked by certifications, incident frequency, time to detect/contain, and audit findings closed on time. Monitor evidence cycle time and cost-to-control. If a metric doesn’t change decisions or speed, change it.