CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceHard
A security architect is reviewing the organization's current state of compliance. A key challenge is that various departments interpret regulatory requirements differently, leading to inconsistent control implementation and difficulty in demonstrating overall compliance to auditors. The architect needs a mechanism to ensure that compliance is consistently achieved and measured across the organization, focusing on the desired secure state rather than just checking off boxes. Which compliance metric approach is MOST effective for this situation?
- AChecklist-based compliance metrics.
- BActivity-based compliance metrics.
- CPolicy-based compliance metrics.
- DOutcome-based compliance metrics.
Show answer & explanationAnswer & explanation
Correct answer: D. Outcome-based compliance metrics.
Outcome-based compliance metrics focus on measuring whether the desired secure state or regulatory objective has been achieved, rather than simply checking if a control has been implemented (activity-based) or a policy exists (policy-based). This approach directly addresses the inconsistency problem by shifting focus to the actual results and effectiveness of controls, making it easier to demonstrate true compliance and align interpretations across departments.
Why the other options are wrong
- A. Checklist-based metrics often lead to 'check-box' compliance without ensuring actual effectiveness or consistent interpretation.
- B. Activity-based metrics track if actions were performed, but not necessarily if those actions achieved the desired secure outcome.
- C. Policy-based metrics confirm policies exist but don't guarantee consistent implementation or desired security outcomes.
Outcome-Based Compliance Metrics
Metrics that measure the achievement of a desired security state or regulatory objective, rather than just the implementation of controls.
- Focuses on effectiveness and results.
- Helps align disparate interpretations of requirements.
- Provides a more accurate picture of true compliance posture.
Memory trick: Outcomes show you the real score, not just the game plan.