Certified Information Security Manager (CISM)Information Security ProgramEasy
A CISO is presenting the annual information security program report to the executive board. The board members are primarily concerned with the financial impact and strategic alignment of security investments. Which type of metric should the CISO PRIORITIZE in the report to best address the board's concerns?
- ATechnical metrics, such as the number of patches deployed and vulnerability scan results.
- BOperational metrics, like the average time to detect (MTTD) and remediate (MTTR) incidents.
- CBusiness-aligned metrics, demonstrating risk reduction, cost avoidance, and impact on strategic objectives.
- DCompliance metrics, detailing adherence to specific regulatory standards and internal policies.
Show answer & explanationAnswer & explanation
Correct answer: C. Business-aligned metrics, demonstrating risk reduction, cost avoidance, and impact on strategic objectives.
Executive boards are primarily concerned with the organization's financial health and strategic direction. Business-aligned metrics translate security activities into terms of risk reduction, cost savings, and support for strategic objectives, directly addressing their concerns.
Why the other options are wrong
- A. Technical metrics are too granular for an executive board and do not directly speak to financial impact or strategic alignment.
- B. Operational metrics are useful for security management but don't provide the high-level financial or strategic context the board requires.
- D. While compliance is important, merely stating adherence might not convey the financial or strategic value unless framed in terms of risk of non-compliance or market advantage.
Business-Aligned Security Metrics
Metrics that translate technical security performance into business language, demonstrating the value, risk reduction, and strategic impact of security investments to executive leadership.
- Focus on financial impact and strategic outcomes.
- Translate technical data into tangible business benefits.
- Essential for securing executive buy-in and funding.
Memory trick: Report to the board: speak their 'Business Benefit' language.