Which of the following BEST indicates an organization's information security posture?

Question

Options

• AThreat analysis results
• BPeriodic policy review
• CVulnerability scan results
• DControls audit report

• A
  3% (1)
• B
  7% (2)
• C
  10% (3)
• D
  80% (24)

Explanation

A controls audit report (D) best indicates an organization's overall security posture because it provides a comprehensive, structured assessment of whether security controls are designed appropriately and operating effectively across the entire organization - giving a holistic view of how well the organization manages risk.

Why the distractors fall short:

• A (Threat analysis) identifies external threats but says nothing about whether the organization has adequate controls in place to counter them.
• B (Periodic policy review) confirms policies exist and are current, but policies on paper don't reflect actual implementation or effectiveness.
• C (Vulnerability scan results) reveals technical weaknesses at a point in time but is narrow in scope - it misses people, processes, and non-technical controls.

Memory tip: Think of "posture" like a physical stance - it reflects your overall readiness, not just one muscle group. Only a controls audit examines the full body (people, processes, technology) to assess whether defenses are actually working, making it the truest measure of security posture.

No community discussion yet for this question.