Question 87 of 871
Key Metrics for Measuring Security Program Effectiveness
An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?
Quick Answer
The answer is mean time to detect (MTTD) security incidents. This metric best demonstrates the effectiveness of the information security program because it directly measures how quickly the organization’s detection controls identify a threat, which is the core of proactive defense. Senior management cares about reducing the window of exposure, so a lower MTTD signals stronger detection capability and faster response readiness. On the Certified Information Security Manager CISM exam, this question tests your understanding that metrics for security program effectiveness must align with business risk and operational impact, not just technical outputs. A common trap is choosing mean time to respond (MTTR) or number of incidents, but MTTD is the primary indicator of detection effectiveness before any response even begins. Remember the memory tip: “Detect first, respond second” — if you can’t detect it quickly, you can’t fix it in time.
⚠ Common exam trap
Many exam-takers confuse activity metrics (e.g., training sessions held) or compliance metrics (e.g., patch percentages) with effectiveness metrics, failing to recognize that senior management needs outcome-based KPIs like MTTD that directly reflect the program's ability to reduce risk and respond to threats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mean time to detect (MTTD) security incidents
Mean time to detect (MTTD) is a key performance indicator that directly measures how quickly the security program identifies incidents, reflecting the effectiveness of detection controls, monitoring tools, and incident response readiness. Unlike compliance-focused metrics, MTTD provides actionable insight into the program's ability to minimize dwell time and reduce potential impact, making it the most relevant metric for senior management to assess program effectiveness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Number of security incidents reported
Why it's wrong here
Does not show effectiveness; could indicate increased reporting.
- ✗
Percentage of systems with up-to-date patches
Why it's wrong here
Operational metric, not strategic for senior management.
- ✗
Number of security awareness training sessions held
Why it's wrong here
Activity metric, not outcome-based.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CISM exam frequently reuses these exact scenarios with slightly different constraints.
✓Mean time to detect (MTTD) security incidentsCorrect answer▾
✗Number of security incidents reportedWrong answer — click to see why▾
Why this is wrong here
Does not show effectiveness; could indicate increased reporting.
✗Percentage of systems with up-to-date patchesWrong answer — click to see why▾
Why this is wrong here
Operational metric, not strategic for senior management.
✗Number of security awareness training sessions heldWrong answer — click to see why▾
Why this is wrong here
Activity metric, not outcome-based.
Analysis generated from the official CISMblueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?
medium- A.Percentage of employees who completed the training.
- ✓ B.Number of security incidents caused by human error.
- C.Average score on post-training tests.
- D.Time taken to complete the training modules.
Why B: The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.
Variation 2. Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?
easy- A.Number of security policies approved.
- ✓ B.Mean time to detect (MTTD) security incidents.
- C.Employee satisfaction score from annual survey.
- ✓ D.Percentage of critical systems patched within 30 days.
- E.Percentage of security budget spent on tools.
Why B: Correct answers are B and D. Option B (Mean time to detect security incidents) directly measures detection effectiveness, a key performance indicator (KPI) for security program effectiveness. Option D (Percentage of critical systems patched within 30 days) measures the effectiveness of vulnerability management and protection. Option A (Number of security policies approved) is a count of administrative actions, not a performance indicator. Option C (Employee satisfaction score) is a general HR metric unrelated to security performance. Option E (Percentage of security budget spent on tools) is a financial metric, not a measure of security program effectiveness.
Variation 3. Which metric is most indicative of security program effectiveness?
easy- A.Security budget spent
- ✓ B.Time to patch critical vulnerabilities
- C.Number of security tools deployed
- D.Number of security incidents
Why B: Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.
Last reviewed: Jul 4, 2026
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.