When establishing metrics for an information security program, the BEST approach is to identify indicators that:

While supporting major initiatives is a good outcome, it's a subset of demonstrating overall program effectiveness and not the primary focus for all metrics.

Reflecting corporate risk culture is important for alignment, but metrics should go beyond culture to objectively measure security performance.

Reducing program spending might be a goal, but it's not the primary purpose of security metrics, which should focus on security posture and effectiveness.

Metrics should primarily measure how well the security program achieves its objectives, such as reducing risk, protecting assets, and ensuring compliance, thereby demonstrating its effectiveness to stakeholders. This allows for data-driven decision-making and continuous improvement of security controls and strategies.