The CISO prepares a quarterly pack for the city manager on security-program health. Which data best serves as key performance and risk indicators?
Select an answer to reveal the explanation.
Short Explanation
KPIs and KRIs are the dashboard lights—patch lag and phish-click trends tell you if the program is improving. Poster counts, coffee uptime, and wallpaper gripes are noise, not risk indicators.
Full Explanation
Key performance and risk indicators quantify whether security processes meet targets and how risk is trending. Patch latency and phishing click rates are classic examples tied to vulnerability management and awareness effectiveness. Facility trivia and aesthetic complaints do not substitute for those process measures in management reporting.