The Chief Information Officer (CIO) has been asked to develop a security dashboard with the relevant metrics. The board of directors will use the dashboard to monitor and track the overall security…

Question

Options

• AKRI:
• BKRI:
• CKRI:
• DKPI:

• A
  3% (2)
• B
  7% (4)
• C
  76% (45)
• D
  14% (8)

Explanation

A board-level security dashboard must combine both KRIs (Key Risk Indicators) and KPIs (Key Performance Indicators) to give directors a complete picture. KRIs are forward-looking metrics that signal emerging or increasing risk - examples include the number of unpatched critical vulnerabilities, volume of detected intrusion attempts, or percentage of third-party vendors failing compliance assessments. KPIs are backward-looking performance metrics that measure how well security operations are functioning - examples include mean time to detect (MTTD), mean time to respond (MTTR), and patch compliance rates. Answer C is correct because it pairs a properly structured KRI section (risk exposure and threat indicators relevant to business impact) with a KPI section (operational effectiveness measures). Boards need both: the KRIs inform strategic risk decisions and budget requests, while KPIs validate that security investments are producing results. Answers A and B present either mismatched or incomplete data pairings, and Answer D leads with KPI data in a way that does not serve the board's primary risk-oversight function.

No community discussion yet for this question.