3 works on record
How to Measure Anything in Cybersecurity Risk
Prove It! Confronting Security with Data
Metrics Manifesto