Information Security Governance →mediumMultiple SelectObjective-mapped

CISM Information Security Governance Practice Question

A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Security investment vs. loss avoidance

Board-level metrics should focus on strategic outcomes such as incident response and financial impact.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Number of security staff per business unit
Why it's wrong here
Staffing ratios are not typically board-level.
✓
Security investment vs. loss avoidance
Why this is correct
Demonstrates ROI and is strategic.
✗
Number of firewall rules changed
Why it's wrong here
Operational details are not board-level.
✓
Mean time to detect (MTTD)
Why this is correct
MTTD indicates detection capability and is a key board-level metric.
✗
Average patch deployment time
Why it's wrong here
Average patch deployment time is an operational metric focused on the speed of remediation workflows, not a strategic indicator of residual risk or business impact that a board requires to oversee security governance. It is tempting because it quantifies a tangible IT process efficiency, and would be correct for a technical operations review or an IT manager’s dashboard where tracking patching velocity against service-level agreements is the primary concern.

Go deeper