A security analyst is preparing a quarterly report for the Chief Information Security Officer (CISO) and the board of directors. The report needs to highlight the organization's overall cybersecurity resilience and strategic progress. Which of the following KPIs would be MOST suitable for this high-level audience?
- ANumber of daily blocked intrusion attempts
- BNumber of detected malware samples per week
- CPercentage of critical business processes protected by advanced security controls
- DAverage CPU utilization of antivirus agents
Show answer & explanationAnswer & explanation
Correct answer: C. Percentage of critical business processes protected by advanced security controls
Executive leadership is interested in strategic resilience and the protection of critical business assets. Measuring the percentage of critical business processes protected by advanced security controls provides a clear, business-focused view of strategic resilience, demonstrating how security investments safeguard the most important organizational functions.
Why the other options are wrong
- A. This is a technical operational metric, too granular for strategic board-level reporting.
- B. This is a technical operational metric, indicating threat activity rather than strategic resilience.
- D. This is an infrastructure performance metric, irrelevant to strategic cybersecurity resilience.
Board-Level Strategic Cybersecurity KPI
A high-level metric designed to communicate the overall effectiveness of cybersecurity programs, strategic risk management, and organizational resilience to a board of directors or executive leadership.
- Focuses on business outcomes and strategic objectives.
- Measures protection of critical assets or processes.
- Avoids technical jargon, uses business language.
- Demonstrates value and return on security investment.
Memory trick: The Board wants to know if 'Critical Business (B)' is 'Protected (P)' and 'Resilient (R)'.