I can also recommend his other books. For me, "how to measure anything in cyber security risk" was excellent.