Leadership wants metrics that warn when the organization's cloud risk exposure is increasing before an incident occurs, such as a rising number of publicly accessible storage buckets or of identities without multifactor authentication. What type of metric should the risk team define?
Select an answer to reveal the explanation.
Short Explanation
Think of a key risk indicator as the dashboard light that comes on before the engine fails. It's forward-looking and it has a threshold that tells you when to act. Counting past incidents is the rearview mirror, useful but too late for an early warning.
Full Explanation
Key risk indicators are metrics that signal changes in risk exposure, ideally before losses occur. Good KRIs are tied to specific risks, measurable from reliable data, trended over time and paired with thresholds that trigger escalation or treatment when crossed. Counts of publicly accessible storage, identities lacking multifactor authentication, unpatched critical vulnerabilities past their deadline or unsanctioned cloud services in use are typical cloud KRIs because each rises as the likelihood of a damaging event rises. Key performance indicators measure how well a process achieves its goals, such as ticket closure speed; they are useful for operations but do not directly track risk exposure. Lagging measures like the number of incidents last quarter describe outcomes that have already happened, so they confirm risk after the fact rather than providing early warning. Annualized loss expectancy is a quantitative estimate produced during risk analysis, and a value calculated once is static, so it cannot reveal that exposure is changing. Exam caveat: KRIs only help if someone owns them and acts on threshold breaches, so they must be reported to the governance body responsible for the risk. Operational check: confirm each KRI has a data source, owner, threshold, reporting frequency and defined escalation path.