This article proposes and applies a qualitative method for measuring the optimal complexity of information security controls for adequate implementation and operations of a public, private, or consortium blockchain within organisations. The method can also be adjusted for blockchain solutions, such as smart contracts, user interfaces, or other related software.