A CISO needs to report the security program's performance to the audit committee. The committee is concerned about compliance with regulatory requirements. Which KPI presentation would be most effective for this audience?

A list of all security incidents from the past year

A summary of the security budget and spending

A chart showing the percentage of systems that passed compliance scans

A technical explanation of the security architecture

A CISO must present the quarterly KPI report to the board of directors. The board is concerned about the organization's cybersecurity risk posture. The CISO has several KPIs available, including operational metrics like MTTD and MTTR, and strategic metrics like risk scores. Which presentation approach is most effective?

Present a detailed technical report with all operational metrics

Present the same report used for the IT operations team

Present only the metrics that show improvement

Present a high-level risk dashboard that includes trend lines for key risk indicators

What is the primary purpose of data analysis in KPI measurement?

To convert raw data into meaningful insights about performance

To make the KPI more complex and detailed

To replace the need for setting targets

To ensure that all data is stored securely

A retail chain's CISO has been using the number of phishing simulation failures as a KPI for employee security awareness. The failure rate has dropped from 25% to 5% over two years. The CISO is considering whether to keep this KPI. What should the CISO do?

Replace the KPI with a new one that measures the number of training courses completed

Keep the KPI unchanged with the same target because it is now easy to achieve

Keep the KPI but adjust the target to a lower failure rate to continue driving improvement

Stop tracking the KPI because the failure rate is low and the problem is solved

A CISO has been using the KPI 'number of security incidents' for two years. The metric has been stable, but the CISO suspects it is not driving any improvement. What is the best way to evaluate this KPI's effectiveness?

Assess whether changes in the KPI correlate with changes in organizational risk

Increase the target for the KPI to force improvement

Continue using the KPI because it is stable and predictable

Compare the KPI to industry benchmarks to see if it is in line

EC-CouncilCertified Chief Information Security Officer

Domain 5Objective 3

Key Performance Indicators (KPI) CCISO Practice Questions (Page 5)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~13–21 in this domain), expect 2–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 21–25

21application · medium
A CISO needs to report the security program's performance to the audit committee. The committee is concerned about compliance with regulatory requirements. Which KPI presentation would be most effective for this audience?
Select an answer first
22expert · hard
A CISO must present the quarterly KPI report to the board of directors. The board is concerned about the organization's cybersecurity risk posture. The CISO has several KPIs available, including operational metrics like MTTD and MTTR, and strategic metrics like risk scores. Which presentation approach is most effective?
Select an answer first
23foundation · easy
What is the primary purpose of data analysis in KPI measurement?
Select an answer first
24application · medium
A retail chain's CISO has been using the number of phishing simulation failures as a KPI for employee security awareness. The failure rate has dropped from 25% to 5% over two years. The CISO is considering whether to keep this KPI. What should the CISO do?
Select an answer first
25application · medium
A CISO has been using the KPI 'number of security incidents' for two years. The metric has been stable, but the CISO suspects it is not driving any improvement. What is the best way to evaluate this KPI's effectiveness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.