CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is preparing a quarterly report on the organization's security posture for the Board of Directors. The board is primarily interested in high-level trends and the overall effectiveness of security investments. Which of the following Key Performance Indicators (KPIs) would be MOST appropriate to include in this report?
- APercentage of security patches applied within 48 hours for critical systems.
- BAverage time to detect (MTTD) and contain (MTTC) critical incidents.
- CCount of daily blocked intrusion attempts by the Web Application Firewall (WAF).
- DNumber of successful phishing emails reported by employees.
Show answer & explanationAnswer & explanation
Correct answer: B. Average time to detect (MTTD) and contain (MTTC) critical incidents.
The Board of Directors needs strategic insights into overall security program effectiveness. MTTD and MTTC for critical incidents provide a holistic view of the organization's ability to respond to significant threats, directly reflecting the return on security investments in a way that is understandable at a high level. Other options are too granular or focused on specific operational aspects.
Why the other options are wrong
- A. This is a tactical metric for patch management, too detailed for the Board's strategic overview.
- C. This is an operational metric showing WAF activity, not a high-level indicator of overall security effectiveness for the Board.
- D. While a useful operational metric, this is too granular for the Board and doesn't represent overall security posture.
Board-Level Security KPIs
High-level metrics that demonstrate the overall effectiveness of the security program and the value of security investments to the Board of Directors.
- Focus on risk reduction, strategic impact, and program maturity.
- Avoid excessive technical detail.
- Examples include incident response times, compliance status, and overall risk posture.
Memory trick: The BOARD wants big picture, fast response, and secure investments.