Key Performance Indicators (KPI) CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A healthcare organization's security team has been tracking the percentage of employees who complete mandatory security awareness training. The data is collected from the learning management system (LMS) and reported monthly to the compliance committee. The CISO notices the KPI has plateaued at 92% for three months despite new hires and contractors being added. What is the most appropriate next step?

   • AChange the KPI to measure the number of training courses offered instead of completion percentage
   • BSegment the data by employee type (e.g., new hire, contractor, full-time) to identify which group is not completing training
   • CReport the plateau as a success because it exceeds the 90% target
   • DIncrease the frequency of reporting from monthly to weekly to make the plateau more visible
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A CISO reviews the KPI 'number of security incidents' and notices it has been steadily decreasing. However, the organization's risk level has not changed. What should the CISO do?

   • AStop tracking security incidents entirely
   • BIncrease the target for incident reduction to drive further improvement
   • CContinue using the KPI because a decrease in incidents is always positive
   • DReplace the KPI with a new one that measures risk reduction directly
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A manufacturing company's CISO wants to develop a KPI to measure the effectiveness of the security operations center (SOC) in containing incidents. The SOC currently tracks the time from detection to containment for each incident. Historical data shows an average of 6 hours, with a best performance of 2 hours. The company's risk appetite requires containing high-severity incidents within 4 hours. What should the CISO set as the initial target for this KPI?

   • A6 hours, because that is the current average and a realistic baseline
   • B4 hours, based on the risk appetite requirement, with a baseline of the historical 6-hour average
   • C2 hours, because that is the best performance ever achieved
   • D8 hours, to allow a buffer for complex incidents
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A regional bank's CISO is building a KPI dashboard for the board. The board wants to see how well the security program is reducing the likelihood of a material data breach. The CISO has access to vulnerability scan data, phishing simulation results, and past incident reports. Which KPI would best align with the board's stated goal?

   • AMean time to detect (MTTD) for security incidents
   • BTotal cost of security tools and services as a percentage of IT budget
   • CPercentage of critical vulnerabilities remediated within the SLA
   • DNumber of security awareness training sessions completed per quarter
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A CISO must present the quarterly security KPI report to the executive team. The report includes technical metrics like mean time to detect (MTTD) and mean time to respond (MTTR). The executives are not security experts. What is the best approach to communicate these KPIs?

   • AProvide a detailed technical appendix and let executives read it on their own
   • BUse trend charts with brief explanations of what each metric means and why it matters
   • CFocus only on the metrics that show improvement and omit the rest
   • DPresent the raw data tables so executives can see the exact numbers
   Reveal Solution Discussion Select an answer first