Q). Out of the follwoing, which is the best metric to manage the information security program?

A. Number of systems subject to intrusion detection.
B. Amount of downtime caused by security incidents.
C. Number of recorded deviations from minimum information security requirements.
D. Time lag between detection, reporting and acting upon security incidents.

Answer:

The information Security Program is a nothing but a standard set of security requirement for an organziation. Thus, the most important security metric would be monitor deviations from the minimum set of security requirements. The answer is thus "C".

More CISM Questions >>

>> Vulnerability Testing
>> Risk Assessment
>> Information Classification
>> Role Based Access Controls