CRISC: Certified in Risk and Information Systems ControlDemo

Question

Which of the following BEST enables the identification of suitable key performance indicators (KPIs) for a risk management program?

A Consulting risk owners
B Evaluating KPIs in accordance with risk appetite
C Aligning with industry best practices
D Reviewing control objectives

Explanation

Control objectives establish the specific outcomes that risk-management controls must achieve; suitable KPIs are derived from those objectives to measure control implementation, effectiveness, efficiency, and program performance. Risk appetite informs acceptable risk limits rather than identifying the performance measures themselves.

Learn more

NIST SP 800-55v1, Measurement Guide for Information Security: Volume 1 — Identifying and Selecting Measures

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ864

Community Discussion