Use continuous monitoring scoring and grading metrics to make information security investment decisions to address persistent issues.