A security help desk is measured on the average time to close tickets. Closure times have fallen sharply, yet the same malware infections keep recurring on the same endpoints. What is the BEST action for the information security manager?
Select an answer to reveal the explanation.
Short Explanation
Tell people you'll pay them by the ticket closed and, guess what, tickets get closed, whether the problem's fixed or not. A lone speed metric invites gaming. The trap is tightening the same target; you pair it with a quality measure so speed can't come at the cost of real fixes.
Full Explanation
Metrics shape behavior, and a single speed measure rewards closing tickets whether or not the underlying problem is solved. The recurring infections on the same endpoints show that the metric is driving the wrong outcome. The manager should balance it with a measure that captures quality, such as reopen or recurrence rate, so the team cannot improve one figure by sacrificing the other. Tightening the closure target amplifies the existing incentive and would likely increase superficial closures and repeat infections. Removing all metrics eliminates the distortion but also eliminates the manager's ability to monitor performance and demonstrate value; the problem is a poorly designed metric set, not measurement itself. Replacing the endpoint product treats a symptom and assumes a technical cause, when the evidence points to a process incentive: the infections persist because tickets are closed before root causes are addressed. Exam caveat: CISM expects candidates to recognize unintended consequences of metrics and to prefer a balanced set over any single indicator. Operational check: track recurrence of the same issue on the same asset within a defined window alongside closure time, review both together each month, and investigate any period where closure speed improves while recurrence also rises.