QuestionQ8Verified/Evaluating a Cloud Compliance ProgramCopy linkReport a problemAsk AstroTutorSave questionWhich objective is MOST suitable for measuring the effectiveness of a password policy?AThe number of related incidents decreases.BAttempts to log with weak credentials increases.CThe number of related incidents increases.DNewly created account credentials satisfy requirements.Show AnswerAnswerExplanationA decrease in password-related incidents is an outcome that can indicate the policy is reducing security risk. By contrast, newly created credentials satisfying policy requirements demonstrates compliance, not necessarily effectiveness. Incident trends should be interpreted alongside changes in detection, reporting, and other security controls. (nvlpubs.nist.gov)Learn moreNIST SP 800-55 Rev. 1: Performance Measurement Guide for Information SecurityNIST SP 800-55 Vol. 1: Identifying and Selecting MeasuresShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion