CRISC · Question #72
The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:
The correct answer is B. successfully within the expected time frame. The most effective KPI for security patching measures the percentage of patches successfully installed within their expected deployment timeframe.
Question
The BEST key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed:
Options
- Aby the security administration team.
- Bsuccessfully within the expected time frame.
- Csuccessfully during the first attempt.
- Dwithout causing an unplanned system outage.
How the community answered
(29 responses)- A7% (2)
- B76% (22)
- C3% (1)
- D14% (4)
Why each option
The most effective KPI for security patching measures the percentage of patches successfully installed within their expected deployment timeframe.
The team responsible for installation is less important than the actual success and timeliness of the patching process.
Measuring the percentage of patches installed successfully within the expected time frame is the most comprehensive KPI for patching effectiveness. This metric directly assesses both the technical success of the installation and the operational efficiency and timeliness, which are critical for mitigating vulnerabilities before they can be exploited.
While successful on the first attempt is good, it doesn't account for timeliness or the overall coverage of patching across the environment.
Avoiding outages is important but doesn't fully capture the effectiveness of timely and comprehensive vulnerability remediation.
Concept tested: Security patching KPI
Source: https://www.nist.gov/cyberframework/online-learning/five-functions/protect
Topics
Community Discussion
No community discussion yet for this question.