CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is preparing a quarterly report for the Chief Information Security Officer (CISO) to highlight the overall security posture and resource allocation effectiveness. The CISO is particularly interested in understanding how efficiently security resources are being utilized to address the most significant threats. Which of the following metrics would BEST address this specific concern?
- ANumber of security awareness training sessions conducted.
- BPercentage of critical vulnerabilities remediated within SLA.
- CTotal security budget spent vs. allocated.
- DNumber of security incidents prevented by automated tools.
Show answer & explanationAnswer & explanation
Correct answer: B. Percentage of critical vulnerabilities remediated within SLA.
The CISO is interested in 'how efficiently security resources are being utilized to address the most significant threats.' Remediating critical vulnerabilities within SLA directly demonstrates this efficiency by showing that high-priority risks are being addressed effectively and within defined performance targets, reflecting good resource allocation.
Why the other options are wrong
- A. Training sessions are important for human risk, but this metric doesn't directly reflect the efficiency of resources addressing technical, significant threats.
- C. Budget variance shows financial management but not the effectiveness or efficiency of how those resources are addressing security threats.
- D. While preventing incidents is good, this metric doesn't directly show efficiency in resource allocation against the 'most significant threats' or how well SLAs are met.
Security Resource Allocation Effectiveness KPI
A Key Performance Indicator (KPI) that measures how effectively security resources (time, budget, personnel) are being utilized to address and mitigate the most significant security risks and threats to an organization.
- Links resource use to risk reduction.
- Often involves measuring remediation performance against SLAs for critical issues.
- Important for strategic decision-making and budget justification.
Memory trick: Resources are 'Efficient' when 'Critical' risks are 'Fixed on Time'.