hardMultiple ChoiceObjective-mapped
Effective Governance Metrics for the Board
A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?
Quick Answer
The answer is the percentage of security controls achieving their intended outcomes as validated by testing. This metric is correct because it directly measures the effectiveness of the security program by confirming that controls actually work as designed, rather than merely tracking activity or compliance. For the Certified Information Security Manager CISM exam, this question tests your ability to distinguish strategic governance metrics from operational or technical ones, a common trap where candidates choose metrics like incident response times or compliance percentages that do not reflect true program effectiveness. When the board requests governance metrics for the board, they need a single, outcome-based indicator that validates whether security investments are producing tangible results. Memory tip: think “validated outcomes, not busy outputs” to avoid confusing activity with effectiveness.
⚠ Common exam trap
It's easy for candidates to confuse activity or compliance metrics (like baseline compliance or incident counts) with effectiveness metrics, failing to recognize that the board needs a direct measure of whether controls actually work, not just that they exist or are followed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Percentage of security controls achieving their intended outcomes as validated by testing.
The best metric because it directly measures whether security controls are functioning as designed, which is the ultimate indicator of security program effectiveness. Unlike input or activity metrics, this outcome-based metric validates that controls achieve their intended purpose, aligning with the board's need for a single, high-level effectiveness measure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Percentage of systems compliant with security baseline.
Why it's wrong here
Compliance does not equal effectiveness; controls may still be inadequate.
- ✗
Number of security incidents reported per month.
Why it's wrong here
This is an operational metric that does not directly indicate program effectiveness.
- ✗
Mean time to detect (MTTD) security events.
Why it's wrong here
This is a technical metric, not a strategic one for the board.
- ✓
Percentage of security controls achieving their intended outcomes as validated by testing.
Why this is correct
This directly measures the effectiveness of the security program.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is the best indicator that an organization has effective information security governance?
easy- A.Achievement of ISO 27001 certification
- B.The security budget has increased year over year
- C.Low number of security incidents
- ✓ D.Security metrics are reviewed by the board quarterly
Why D: (ISO 27001 certification) indicates compliance, not necessarily governance performance. Option B (security budget increased) does not guarantee effectiveness. Option C (low number of incidents) could be due to luck. Option D (board review of metrics) demonstrates governance oversight and strategic alignment.
Variation 2. An information security manager is developing a security scorecard for the board. Which of the following should be included to BEST demonstrate governance performance?
easy- A.Total number of security incidents this quarter
- B.Percentage of systems patched within 30 days
- C.Employee security training completion rate
- ✓ D.Number of risk acceptances approved vs. rejected
Why D: The number of risk acceptances approved vs. rejected directly reflects the board's governance of risk appetite and decision-making. It shows how management formally accepts residual risk, which is a key governance function, unlike operational metrics that measure tactical execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.