After approving a new information security strategy, board members ask how they will know whether it is working. Which measure would BEST answer their question?
Select an answer to reveal the explanation.
Short Explanation
The board doesn't want to know how busy you are; it wants to know whether the business is safer in the ways that matter. Show progress toward the risk levels and outcomes the strategy promised. The trap is answering with activity counts, which can climb while risk stays exactly where it was.
Full Explanation
A strategy is working when the organization is moving toward the business outcomes and risk levels it was designed to achieve. Board-level measures should therefore show progress against agreed targets, such as risk exposure for critical business processes relative to appetite, readiness to support new business initiatives securely, and achievement of strategic objectives, expressed in business terms. The number of tools deployed and vulnerabilities patched measures activity and output; those figures can increase while the exposures that matter most are untouched, and they do not tell the board whether risk is within appetite. Training completion shows that a compliance requirement is being met but says little about behavior change or overall risk. Incident counts are ambiguous at board level; a rise may reflect better detection rather than worse security, and a fall may reflect blind spots, so without context they do not indicate strategic success. Exam caveat: operational metrics remain valuable to management for running the program; the issue is choosing the measure that answers the board's governance question. Operational check: confirm each board metric links to a strategic objective, has a target and a trend, and is accompanied by a short narrative explaining what it means for business risk.