hardMultiple Choice
Effective Governance Metrics for the Board
A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?
Quick Answer
The answer is the percentage of security controls achieving their intended outcomes as validated by testing. This metric is correct because it directly measures the effectiveness of the security program by confirming that controls actually work as designed, rather than merely tracking activity or compliance. For the Certified Information Security Manager CISM exam, this question tests your ability to distinguish strategic governance metrics from operational or technical ones, a common trap where candidates choose metrics like incident response times or compliance percentages that do not reflect true program effectiveness. When the board requests governance metrics for the board, they need a single, outcome-based indicator that validates whether security investments are producing tangible results. Memory tip: think “validated outcomes, not busy outputs” to avoid confusing activity with effectiveness.
⚠ Common exam trap
It's easy for candidates to confuse activity or compliance metrics (like baseline compliance or incident counts) with effectiveness metrics, failing to recognize that the board needs a direct measure of whether controls actually work, not just that they exist or are followed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Percentage of security controls achieving their intended outcomes as validated by testing.
The best metric because it directly measures whether security controls are functioning as designed, which is the ultimate indicator of security program effectiveness. Unlike input or activity metrics, this outcome-based metric validates that controls achieve their intended purpose, aligning with the board's need for a single, high-level effectiveness measure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Percentage of systems compliant with security baseline.
Why it's wrong here
Baseline compliance measures configuration adherence, not whether controls actually reduce risk or incidents, so it cannot evidence program effectiveness to the board. It is tempting because compliance percentage is easy to report and track, and it would suit an audit-readiness or configuration-drift question rather than one asking for overall security effectiveness.
- ✗
Number of security incidents reported per month.
Why it's wrong here
Incident counts fluctuate with reporting culture, threat volume and detection sensitivity, so a rising or falling number does not indicate program effectiveness. It is tempting because it is simple and readily available, and it would suit a question about incident volume trending or reporting workload rather than governance effectiveness.
- ✗
Mean time to detect (MTTD) security events.
Why it's wrong here
MTTD measures detection speed only, ignoring prevention, response and recovery, so it cannot represent the whole program's effectiveness. It is tempting because detection latency is quantifiable and relevant, and it would be the right metric for a question specifically about monitoring or SOC detection capability.
- ✓
Percentage of security controls achieving their intended outcomes as validated by testing.
Why this is correct
Testing validates whether controls actually work, so this metric measures realised effectiveness rather than activity or coverage. It directly answers the board's request for a single outcome-based indicator, unlike counts of incidents, policies or training completion, which reflect effort or exposure rather than governance performance.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is the best indicator that an organization has effective information security governance?
easy- A.Achievement of ISO 27001 certification
- B.The security budget has increased year over year
- C.Low number of security incidents
- ✓ D.Security metrics are reviewed by the board quarterly
Why D: (ISO 27001 certification) indicates compliance, not necessarily governance performance. Option B (security budget increased) does not guarantee effectiveness. Option C (low number of incidents) could be due to luck. Option D (board review of metrics) demonstrates governance oversight and strategic alignment.
Variation 2. An information security manager is developing a security scorecard for the board. Which of the following should be included to BEST demonstrate governance performance?
easy- A.Total number of security incidents this quarter
- B.Percentage of systems patched within 30 days
- C.Employee security training completion rate
- ✓ D.Number of risk acceptances approved vs. rejected
Why D: The number of risk acceptances approved vs. rejected directly reflects the board's governance of risk appetite and decision-making. It shows how management formally accepts residual risk, which is a key governance function, unlike operational metrics that measure tactical execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.