Certified Information Security Manager (CISM)Information Security ProgramHard
A CISO is presenting the information security program's performance to the steering committee. The committee is highly focused on quantifying the financial justification for security investments. The CISO wants to demonstrate the tangible value of the program's risk reduction efforts. Which of the following metrics would be MOST effective in achieving this goal?
- APercentage of employees who completed security awareness training.
- BNumber of security incidents detected and blocked.
- CCompliance score against industry-specific regulations.
- DAnnualized Loss Expectancy (ALE) reduction due to implemented controls.
Show answer & explanationAnswer & explanation
Correct answer: D. Annualized Loss Expectancy (ALE) reduction due to implemented controls.
The steering committee's focus on financial justification and quantifying value aligns directly with Annualized Loss Expectancy (ALE) reduction. ALE provides a monetary value of potential losses and by demonstrating how security controls reduce this figure, the CISO can directly articulate the financial benefit and ROI of the security program.
Why the other options are wrong
- A. Training completion is an operational metric that doesn't directly translate to financial justification or risk reduction in monetary terms.
- B. While important, simply stating incident counts doesn't directly quantify the financial impact or value of the program to a financially-focused committee.
- C. Compliance scores show adherence but don't inherently quantify financial risk reduction or program value in monetary terms, unless tied to fines or business impact.
Annualized Loss Expectancy (ALE) Reduction
A metric that quantifies the financial benefit of information security controls by calculating the reduction in expected annual losses due to the implementation of those controls.
- Directly links security to financial outcomes.
- Useful for justifying security investments.
- Requires calculation of ARO and SLE.
Memory trick: To show security's worth, 'Reduce the ALE' for financial clarity.