What standard would you use to help determine key performance indicators?

Question

Options

• AITIL
• BFIPS140-2
• CNI5TSP800-53
• DNISTSP800-5S

• A
  10% (2)
• B
  5% (1)
• C
  10% (2)
• D
  75% (15)

Explanation

NIST SP 800-55 ("Performance Measurement Guide for Information Security") is purpose-built for defining and implementing Key Performance Indicators (KPIs) for information security programs - it walks through selecting, developing, and analyzing security metrics, making it the direct answer.

Why the distractors are wrong:

• A (ITIL): ITIL is an IT service management framework focused on service delivery best practices, not a measurement standard for defining security KPIs.
• B (FIPS 140-2): This is a cryptographic module security standard - it defines requirements for encryption hardware/software, with no connection to performance measurement.
• C (NIST SP 800-53): This standard defines security and privacy controls for federal systems - it tells you what controls to implement, not how to measure their performance.

Memory tip: Think "800-55 = measuring how well things are going" - the number 55 evokes "five-by-five," a communications phrase meaning everything is performing clearly and correctly. If you're measuring KPIs, you want to know if your security program is running "five-by-five," so reach for SP 800-55.

No community discussion yet for this question.