CISM Question 50

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  Senior management needs concise, measurable information that answers questions. KPIs provide exactly this type of information through measurable indicators. Risk assessments identify and evaluate risk. They do not directly indicate whether the organization is complying with policies or regulatory requirements. An organization can be compliant yet still have significant risks, or vice versa. If the question asks "How do you know how well you're doing?" → Think metrics/KPIs. If it asks "What is the level of risk?" → Think risk assessment. If it asks "What happens if a process fails?" → Think BIA.

• Chose A1

  A KPIs are tailored, performance-oriented metrics that are well-suited to convey the status of information security compliance to senior management in a clear and actionable manner.

• Chose A1

  Key performance indicators (KPIs) are measurable metrics that provide a clear and concise way to communicate the status of information security compliance to senior management. KPIs can include metrics related to policy adherence, incident response effectiveness, vulnerability management, and other aspects of the organization's information security program. Using KPIs allows senior management to quickly grasp the current state of compliance and make informed decisions based on measurable data. While risk assessment results (option B), industry benchmarks (option C), and business impact analysis (BIA) results (option D) are valuable for various aspects of information security management, KPIs are specifically designed to provide a snapshot of the performance and compliance status, making them a more focused and direct communication tool for senior management.