Exam CISM topic 1 question 494 discussion

This answer is like "all of the above".

The primary purpose of deploying information security metrics is to provide information that is needed to make informed decisions regarding the organization's security posture and to help in managing and improving security. While the other options (A, B, and C) may be secondary benefits of using security metrics, the primary goal is to provide data and insights that enable decision-makers to assess the effectiveness of security measures, identify vulnerabilities, and allocate resources appropriately to address security risks.

D. provide information needed to make decisions.

D. provide information needed to make decisions.

The PRIMARY purpose for metrics is to see if the controls implemented are actually doing what they're supposed to do.

Per ISACA Review Manual, Sec 3.7.1: "The fundamental purpose of metrics, measures, and monitoring is decision support."

This is the most reasonable answer.

The PRIMARY purpose for deploying information security metrics is to provide information needed to make decisions (Option D)

D. provide information needed to make decisions. The primary purpose for deploying information security metrics is to provide the organization with the information it needs to make informed decisions about the management and protection of its information assets. This includes measuring the effectiveness of the organization's information security program, identifying areas for improvement, and tracking progress over time.

I think B

I think is A because is asked about the PRIMARY. And the primary should be making sure things are working as suppose, only after that can support making decisions.

Agreed on D

Why not D ?