CISA: Certified Information Systems Auditor

Established security metrics measure actual security performance against defined expectations across the organization. Their achievement provides evidence of outcomes, whereas senior-management approval, use of a recognized standard, and a comprehensive awareness program demonstrate support or controls rather than confirmed fulfillment of expectations.