Risk wants an early warning when failed logins spike on the citizen portal. Which configuration is appropriate?

Early warning for failed-login spikes on a citizen portal is configured as a key risk indicator on the related portal risk that tracks those spikes against a threshold. The KRI attaches measurable precursor signal to the technology risk so the register can respond before outage or breach narratives dominate public attention. Civic digital services especially benefit from login-anomaly leading indicators.

Creating a service catalog item titled Failed Login and closing it weekly is an ITSM request pattern, not a risk indicator. Opening a security incident for every failed login before updating any indicator floods SIR and never establishes thresholded risk measurement. Storing login counts only in a personal spreadsheet linked from risk notes leaves monitoring outside IRM’s indicator framework.

Exam caveat: KRIs are IRM measurement objects on risks (or controls)—not catalog items, not mandatory per-event SIR cases, not personal sheets.

Operational check: create the failed-login KRI on the portal risk; set threshold and collection; simulate a spike; confirm risk attention or issue routing per design without opening an incident per failed attempt.

Threshold design for failed-login KRIs should distinguish burst anomalies from baseline citizen traffic so seasonal filing deadlines do not create permanent red status without meaning. Tie ownership of the indicator to the portal risk owner and security operations contact so breached thresholds create risk attention and coordinated response without auto-opening an incident for every single failure event. Review false-positive rates monthly and retune, keeping the KRI alive as a leading civic signal rather than retiring it for noise.