I came across this good reference on attributes and suggested ways to measure them. Of course, the Blue Book (https://www.amazon.com/Enterprise-Security-Architecture-Business-Driven-Approach/dp/157820318X) has them as well.

If you don’t know about SABSA or attributes, you are seriously missing out on an incredible tool for solving problems and delivering measurably effective and stakeholder aligned architectures.

https://onlinelibrary.wiley.com/doi/pdf/10.1002/9780470476017.app1