Exam CISM topic 1 question 68 discussion

D. demonstrate the effectiveness of the security program. When establishing metrics for an information security program, the BEST approach is to identify indicators that demonstrate the effectiveness of the security program. These metrics should measure the performance of the security controls in place, such as incident response time, vulnerability management, compliance with standards and regulations, and the overall effectiveness of the security program. By using these metrics, the organization can see how well the security program is working and make necessary adjustments.

When establishing metrics for an information security program, it is important to focus on indicators that demonstrate the effectiveness of the security program. These metrics should provide insights into the program's performance, its ability to mitigate risks, and its overall impact on the organization's security posture. Metrics that demonstrate effectiveness help in assessing the success of security initiatives and provide valuable information for decision-making and continuous improvement.

Metrics in an information security program should focus on demonstrating the effectiveness of the security measures and their contribution to the overall security posture. Effectiveness metrics help assess how well security controls are working, the level of risk reduction achieved, and the program's ability to meet its objectives. These metrics provide valuable insights for decision-makers and help in continuous improvement efforts. While supporting major information security initiatives (option A) is important, the primary goal is to measure effectiveness. Reflecting the corporate risk culture (option B) is important but might not directly measure program effectiveness. Metrics that reduce information security program spending (option C) may not necessarily align with the goal of demonstrating effectiveness and may not provide a comprehensive view of the security program's success.

D. demonstrate the effectiveness of the security program.

https://www.isaca.org/resources/isaca-journal/issues/2020/volume-6/key-performance-indicators-for-security-governance-part-1

D, clearly. Effectiveness is the keyword here.