Which part of the ISA/IEC 62443 series describes a methodology to develop quantitative metrics?

ISA/IEC 62443-1-3 specifically provides guidance on developing quantitative metrics for evaluating the effectiveness of IACS security programs. This part introduces models and methods to create meaningful security program ratings, allowing organizations to quantitatively measure their security maturity and the effectiveness of security controls over time.