Which of the following would MOST effectively communicate the maturity of an information security program to executive management?

The correct answer is B. Industry benchmarks. Industry benchmarks allow executive management to understand the maturity of an information security program by comparing it against peer organizations or recognized standards, which is more meaningful at an executive level than technical metrics or isolated indicators.

Submitted by carter_n· Apr 18, 2026Information Security Program Development and Management

Question

Options

AThreat models
BIndustry benchmarks
CKey performance indicators (KPIs)
DKey risk indicators (KRIs)

How the community answered

(30 responses)

A
10% (3)
B
83% (25)
C
3% (1)
D
3% (1)

Explanation

Industry benchmarks allow executive management to understand the maturity of an information security program by comparing it against peer organizations or recognized standards, which is more meaningful at an executive level than technical metrics or isolated indicators.

Topics

#Information Security Program#Program Maturity#Executive Reporting#Industry Benchmarks

Community Discussion

No community discussion yet for this question.

Full CISM Practice