CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ169

Information Security Risk Management

When identifying key risk indicators (KRIs) for an information security program, it is MOST important to select:

  • A KRIs that track both short-term and long-term performance.
  • B KRIs that align with business processes.
  • C KRIs that are quantifiable.
  • D as many KRIs as possible to catch risk events from the broadest areas.
Explanation

Key risk indicators are most effective when they relate directly to business processes, because this makes the indicators relevant to operational risk exposure and supports meaningful risk-based decisions.

Community Discussion

No comments yet. Be the first to start the discussion!