CRISC · Question #640
The patch management process is MOST effectively monitored through which of the following key control indicators (KCIs)?
The correct answer is B. Percentage of patches deployed within the target time frame. The percentage of patches deployed within the target time frame directly measures whether the patch management process is achieving its primary objective: reducing the vulnerability exposure window in a timely manner. This KCI reflects both process efficiency and security effecti
Question
The patch management process is MOST effectively monitored through which of the following key control indicators (KCIs)?
Options
- ANumber of legacy servers out of support
- BPercentage of patches deployed within the target time frame
- CNumber of patches deployed outside of business hours
- DPercentage of patched systems tested
How the community answered
(31 responses)- A13% (4)
- B77% (24)
- C6% (2)
- D3% (1)
Explanation
The percentage of patches deployed within the target time frame directly measures whether the patch management process is achieving its primary objective: reducing the vulnerability exposure window in a timely manner. This KCI reflects both process efficiency and security effectiveness. The number of legacy servers out of support (A) is a risk indicator, not a control performance measure. Patches deployed outside business hours (C) measures scheduling compliance, not overall effectiveness. The percentage of patched systems tested (D) measures a quality step within the process but not the outcome of the overall process.
Topics
Community Discussion
No community discussion yet for this question.