A department proposes 'improve security awareness' as one of its security metrics for the coming year. How should the information security manager BEST improve this proposal?
Select an answer to reveal the explanation.
Short Explanation
'Get healthier' isn't a goal you can check; 'walk 10,000 steps a day by June' is. A metric has to be specific, measurable and time-bound, and counting emails you sent doesn't measure what people actually learned.
Full Explanation
A metric must be specific and measurable, with a defined target and time frame, so that progress can be assessed objectively and decisions can be based on it. Improve security awareness is a goal, not a metric: it gives no measure, no baseline and no way to tell whether it has been achieved. Restating it as a measurable target tied to the desired behavior, such as reaching a defined rate of employees reporting simulated phishing messages by a given date, makes it actionable and allows the department to track trends. Keeping the broad wording preserves the flexibility of methods but leaves nothing to measure, so success cannot be demonstrated and resources cannot be justified. Counting awareness emails sent is measurable but tracks activity rather than outcomes; many emails can be sent while behavior stays unchanged. Self-rated awareness in an annual survey is subjective, prone to overconfidence and measured too infrequently to guide improvement, so it is a weak indicator of actual behavior. Exam caveat: good metrics also need a baseline and an owner, and outcome measures can be supported by activity measures that explain them. Operational check: confirm the restated metric documents its calculation, baseline, target, date, data source and owner before the year begins.