When determining key risk indicators (KRIs) for use in an information security program it is MOST important to select:

While tracking both short-term and long-term performance is good, it's secondary to ensuring the KRIs are fundamentally relevant to the business.

For KRIs to be truly valuable, they must directly relate to and provide early warning signs for risks that could impact the organization's critical business processes and strategic objectives. Aligning KRIs with business processes ensures that risk monitoring is relevant and actionable from a business perspective.

Quantifiability is a characteristic of a *good* KRI, but the *most important* aspect is its relevance and alignment with what the business values.

Selecting too many KRIs can lead to "indicator fatigue" and diminish the focus on truly critical risks; quality and relevance are more important than quantity.