How can organizational management measure the success of their network security?

How can organizational management measure the success of their network security? Please provide an example and references.