CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security operations center (SOC) manager is reviewing Key Performance Indicators (KPIs) for the past quarter. One KPI shows an increasing trend in 'Mean Time To Contain (MTTC)' incidents. The manager needs to communicate this finding to the CISO and propose improvements. Which of the following approaches is MOST effective for this communication?
- APresent a raw data table of MTTC values over the quarter to the CISO.
- BSchedule a meeting with the SOC team to discuss the MTTC trend internally and then report back to the CISO once improvements are made.
- CProvide a graphical trend of MTTC, explain potential causes (e.g., alert fatigue), and suggest targeted training or automation solutions.
- DSend an email stating 'MTTC is increasing, we need more staff'.
Show answer & explanationAnswer & explanation
Correct answer: C. Provide a graphical trend of MTTC, explain potential causes (e.g., alert fatigue), and suggest targeted training or automation solutions.
Presenting a graphical trend of MTTC provides clear visualization for the CISO. Explaining potential causes adds necessary context, and suggesting concrete solutions demonstrates proactive problem-solving, making it an effective communication strategy for driving improvements.
Why the other options are wrong
- A. Raw data without context or analysis is difficult for executive-level stakeholders to interpret and act upon.
- B. Delaying communication to the CISO until improvements are made is not proactive; the CISO needs to be aware of deteriorating KPIs and proposed solutions for informed decision-making.
- D. This is an unconstructive and unsubstantiated claim; it lacks data, analysis, and specific solutions.
KPI Reporting for Executives
Communicating key performance indicators to executive leadership in a clear, concise, and actionable manner, focusing on trends, impact, and proposed solutions.
- Use visualizations for trends.
- Provide context and analysis.
- Offer actionable recommendations.
Memory trick: CISO wants trends, reasons, and remedies, not just raw numbers.