The draft annual security program report lists projects completed, tools deployed and training sessions delivered. The CEO asks whether the organization is actually more secure than last year. What change would BEST answer that question?
Select an answer to reveal the explanation.
Short Explanation
Counting what you did is like a gym log that shows hours, not whether you got any stronger. The CEO's asking about results, so you show how risk and control effectiveness moved against the goals you set. More activities, more tickets or a raw pen test dump just make the log longer.
Full Explanation
Activity reporting answers what the security function did; effectiveness reporting answers whether it achieved anything. To tell whether the organization is more secure, the report needs outcome measures tied to program objectives, such as changes in residual risk for key risk scenarios, results of control testing, time to detect and contain significant incidents, and progress on reducing exposures that matter to the business. Presented as trends against targets, these show whether the program is reducing risk. Comparing spend with budget shows financial discipline but says nothing about security outcomes; a program can be exactly on budget and ineffective. Adding every closed ticket makes the report longer while remaining an activity measure, and it buries the signal executives need. Attaching a full penetration test report gives a technical snapshot of selected systems at one time, without context, prioritization or comparison to objectives, and the CEO cannot interpret it. Exam caveat: activity measures still have a place in operational management; they simply cannot answer a question about effectiveness. Operational check: for each program objective, confirm there is at least one outcome metric with a baseline, a target and this year's result.