The security operations center collects detailed data on detection times, alert volumes and analyst workload. The chief financial officer now also wants a security view drawn from the same data. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Same groceries, two different meals. The SOC lead wants the detailed recipe and you give the CFO the finished dish: what it costs and what it protects, rather than serving both the same raw ingredients.
Full Explanation
The same underlying data can support different audiences, but each needs metrics suited to the decisions it makes. The SOC lead manages day-to-day operations and needs detailed operational metrics, such as detection and response times, alert volumes and analyst workload, to tune processes and staffing. The CFO is concerned with cost, value and financial exposure and needs aggregated measures that link security operations to business impact, such as cost per incident, trends in losses avoided or financial exposure of critical services. Giving both the same detailed dashboard achieves surface consistency but leaves the CFO with information that is hard to interpret and irrelevant to financial decisions. Handing the CFO raw data shifts interpretation to people without the security context needed to analyze it correctly and risks conflicting conclusions. Excluding the CFO ignores that the CFO is a legitimate stakeholder in security spending and risk and is often central to budget decisions. Exam caveat: tailored metrics must still trace to the same data so that different views remain consistent and defensible. Operational check: confirm a metrics catalog lists each metric with its audience, purpose and source, and that the CFO measures reconcile with the operational figures.