Which of the following is the BEST reason for the use of security metrics?

Question

Options

• AThey ensure that the organization meets its security objectives.
• BThey provide an appropriate framework for Information Technology (IT) governance.
• CThey speed up the process of quantitative risk assessment.
• DThey quantify the effectiveness of security processes.

• A
  3% (1)
• B
  94% (31)
• C
  3% (1)

Explanation

Option B is correct because security metrics provide management with objective, quantifiable data to make informed decisions about security investments, policy, and accountability - all of which are foundational to IT governance. Governance requires measurable evidence to direct and control organizational resources, and security metrics supply exactly that measurable foundation.

Why the distractors are wrong:

• A overstates what metrics do - they measure progress toward objectives but cannot ensure those objectives are met; that requires effective controls and management action.
• C is too narrow; while metrics can inform risk assessments, accelerating quantitative risk assessment is a secondary, incidental benefit, not the primary purpose.
• D is partially true but describes only one function of metrics (measuring control effectiveness) rather than the broader strategic value they provide to governance decision-making.

Memory tip: Think of the acronym GDM - Governance needs Data to Make decisions. Metrics are that data layer. When an exam asks for the "BEST" reason, look for the answer that connects security metrics to the highest-level organizational purpose (governance), not just a technical function.

No community discussion yet for this question.