Management has funded a new vulnerability management program and asks the information security manager to demonstrate, within a year, that it has improved the organization's security posture. What should the manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
You can't say you lost ten pounds if you never stepped on the scale before the diet. Improvement only means something against a starting point. The trap here is jumping to tools or year-end tests before you've captured where you stand today.
Full Explanation
Demonstrating improvement requires a comparison, and a comparison requires a baseline captured before the program changes the environment. The manager should agree with management which measures reflect the program's objectives, such as exposure time for critical vulnerabilities or the share of critical assets meeting the remediation standard, and record current values now. Once the program is running, the same measures taken the same way show the trend and support the claim of improvement. A penetration test at the end of the year produces a single snapshot; without an equivalent starting point it cannot show that anything changed because of the program. A dashboard product is a presentation choice that comes after deciding what to measure and capturing the baseline, and buying one first risks shaping the metrics around the tool. A monthly patch count is an activity measure that rises with effort, not necessarily with reduced risk, and it has no reference point either. Exam caveat: when a question asks how to show the value or progress of a program, the baseline is almost always the first step. Operational check: confirm that each agreed metric has a documented definition, data source and starting value dated before the program launch, and that management has accepted those values as the reference.