Which of the following is the BEST reason for the use of security metrics?

Security metrics measure and report on security performance, but they do not inherently ensure that objectives are met - that is the role of security controls, governance processes, and management oversight.

IT governance frameworks (such as COBIT or ISO 38500) provide structural guidance for aligning IT with business goals; security metrics are an input to governance but do not constitute a governance framework themselves.

Quantitative risk assessment relies on probability and impact data, threat modeling, and asset valuation methodologies; while metrics can inform risk assessments, accelerating the risk assessment process is not the primary purpose of security metrics.

The primary purpose of security metrics is to quantify the effectiveness of security processes by converting qualitative security activities into measurable, objective data points. This allows organizations to track performance over time, identify weaknesses, and demonstrate the value of security investments with concrete evidence rather than subjective assessments.