Government needs to do more than simply collect raw measurements if it wants to really understand the impact of any initiative, including in the realm of cybersecurity.