The eagerly awaited update to the NIST Cybersecurity Framework is out in draft form — and it includes metrics and measurements.