What is the primary goal of reporting security metrics to stakeholders?

To replace the need for risk assessments

To support decision-making and accountability

To demonstrate the technical complexity of security

To ensure all stakeholders understand every technical detail

Which of the following is an example of a Key Performance Indicator (KPI) for a security program?

Percentage of critical vulnerabilities remediated within the defined SLA

Risk appetite statement approved by the board

List of security incidents reported in the last month

Number of new risk indicators identified in the last quarter

A CISO is preparing a quarterly security report for the board of directors, which includes members with no technical background. The board's primary concern is understanding whether the organization's security posture is improving. Which approach should the CISO take when reporting the metrics?

Report only the metrics that show improvement and omit those that have regressed

Provide a detailed technical appendix with raw data from all security tools

Present a dashboard of all tracked metrics with their current values and historical trends

Show a small set of KPIs with a clear trend line and a summary statement of whether the posture is improving

How can metric trends be used to drive security program improvements?

By eliminating the need for stakeholder reporting

By replacing the need for risk assessments

By identifying weaknesses and prioritizing improvements based on deviations

By automatically fixing security issues

A manufacturing company's strategic objective is to ensure the availability of its production control systems. The security team is selecting metrics for the board dashboard. Which metric is most directly aligned with the availability objective?

Percentage of planned maintenance windows for production systems that were completed without unplanned downtime

Number of firewall rule changes approved in the last month

Number of security incidents affecting production systems in the last quarter

Percentage of production systems with up-to-date antivirus signatures

Information Systems Security Management Professional

Domain 1Objective 7

1.7 Define, Measure, and Report Security Metrics ISSMP Practice Questions (Page 3)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

21%of the exam

Questions 11–15

11foundation · easy
What is the primary goal of reporting security metrics to stakeholders?
Select an answer first
12foundation · easy
Which of the following is an example of a Key Performance Indicator (KPI) for a security program?
Select an answer first
13application · medium
A CISO is preparing a quarterly security report for the board of directors, which includes members with no technical background. The board's primary concern is understanding whether the organization's security posture is improving. Which approach should the CISO take when reporting the metrics?
Select an answer first
14foundation · easy
How can metric trends be used to drive security program improvements?
Select an answer first
15application · medium
A manufacturing company's strategic objective is to ensure the availability of its production control systems. The security team is selecting metrics for the board dashboard. Which metric is most directly aligned with the availability objective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.