Key Performance Indicators (KPI) ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A university's CISO wants to measure the percentage of faculty and staff who complete security awareness training. The university uses multiple learning management systems (LMS) across departments, and some training is delivered in person. Which data collection method would provide the most reliable data for this KPI?

   • AConduct a post-training survey to ask employees if they completed the training
   • BUse a single centralized LMS and require all training completion to be recorded there
   • CEstimate completion based on the number of employees who attended at least one training session
   • DAsk department heads to report completion numbers from their local records
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A CISO is reviewing the quarterly KPI report. The 'percentage of systems with endpoint protection' KPI is at 99%, but the 'number of endpoint compromises' has increased by 20%. The CISO suspects the KPI is not measuring the right thing. What is the most appropriate next step?

   • ARemove the KPI from the report
   • BReport the KPI only to the security team
   • CConduct a root cause analysis to understand why compromises increased despite high coverage
   • DIncrease the target for endpoint protection to 100%
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A CISO is preparing a quarterly report for the board. The board wants to understand the overall health of the security program, not just individual metrics. The CISO has data on incident counts, vulnerability remediation rates, and budget variance. Which reporting approach would best serve the board's need?

   • AList all KPIs in a table with raw numbers and no interpretation
   • BProvide a detailed technical analysis of each KPI's data collection methodology
   • CPresent a single score that combines multiple KPIs into an overall security health index
   • DFocus only on the KPIs that are trending positively
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An organization's KPI for 'percentage of endpoints with full disk encryption' has been at 100% for a year. The CISO is reviewing the KPI set and notices that the organization has shifted to a remote-first work model with a mix of corporate and personal devices. What should the CISO do to keep the KPI relevant?

   • AExpand the KPI to include encryption coverage on personal devices that access corporate data
   • BReplace the KPI with a measure of the number of personal devices used for work
   • CRemove the KPI because it is no longer challenging
   • DKeep the KPI unchanged because it is a security best practice
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A CISO wants to track the mean time to detect (MTTD) security incidents. The security team manually logs detection times in a spreadsheet. What is the most critical concern with this data collection method?

   • AThe team may not know how to use the spreadsheet
   • BManual logging is prone to errors and inconsistencies
   • CThe spreadsheet may not be accessible to all team members
   • DThe spreadsheet cannot store historical data
   Reveal Solution Discussion Select an answer first