The executive committee asks the information security manager for one security metric to review each quarter. Which metric would be MOST useful to them?
Select an answer to reveal the explanation.
Short Explanation
Executives don't care how many punches you blocked; they care whether the business is still standing. A residual-risk trend for critical services against appetite tells them that, while blocked-malware counts are just noise at that level.
Full Explanation
Executive metrics should support decisions about the business: whether risk is acceptable, whether investment is working and where attention is needed. A trend in residual risk to critical business services, compared with the agreed risk appetite, links security directly to business outcomes, shows direction over time and highlights where the organization is outside its tolerance. Counts of blocked malware describe the volume of threats encountered and tool activity; they fluctuate with external attack levels and tool tuning and say nothing about whether business risk is acceptable. The share of firewall rule changes handled within the service target is an operational performance measure for a specific process, useful to IT management but too narrow and technical to inform executive decisions. The number of vulnerability scans completed is an activity measure that shows effort rather than results; many scans can coexist with high unremediated risk. Exam caveat: operational metrics remain essential inputs for managers and can feed executive measures, but they should be aggregated and translated rather than reported directly. Operational check: confirm the executive metric has a defined calculation, data sources, owner and appetite threshold, and that changes in its trend are explained in each report.