Which elements constitute a security metric program in Annex B?

Which elements constitute a security metric program in Annex B?

• A. Qualitative impressions from leadership without data.
• B. No predefined metrics; ad hoc assessments.
• C. Only annual security audits without ongoing metrics.
• D. Defined KPIs, baselines, measurement methods, regular reporting, and actions based on findings.

Answer: (D)

A security metric program is about turning security into a measurable, repeatable process. The best answer includes defined KPIs to quantify performance, baselines to establish what is normal or expected, robust measurement methods so data is collected consistently, regular reporting to keep stakeholders informed, and actions based on findings to drive improvements. These elements together create a data-driven approach to monitor and improve security over time. Without data, you’d rely on impressions rather than objective trends. Without predefined metrics, there’s no standard to measure against. Relying only on annual audits misses the ongoing measurement and timely remediation that a true metric program provides.

A security metric program is about turning security into a measurable, repeatable process. The best answer includes defined KPIs to quantify performance, baselines to establish what is normal or expected, robust measurement methods so data is collected consistently, regular reporting to keep stakeholders informed, and actions based on findings to drive improvements.

These elements together create a data-driven approach to monitor and improve security over time. Without data, you’d rely on impressions rather than objective trends. Without predefined metrics, there’s no standard to measure against. Relying only on annual audits misses the ongoing measurement and timely remediation that a true metric program provides.