Following a major ransomware incident affecting critical infrastructure, the CISO must present a lessons learned briefing to the board of directors. Which metrics would most effectively communicate the security program's effectiveness and improvement needs?

Question

Accepted Answer

A. Mean time to detect (MTTD), mean time to respond (MTTR), scope of impact, and specific gaps identified with remediation timelines. Board-level post-incident reporting requires business-relevant security metrics: MTTD measures detection efficiency, MTTR measures response efficiency, scope of impact quantifies business damage, and specific gaps with remediation timelines demonstrate accountability and improvement planning. The CySA+ Reporting and Communication domain covers incident response reporting metrics, KPIs, and lessons learned for stakeholder audiences.

Following a major ransomware incident affecting critical infrastructure, the CISO must present a lessons learned briefing to the board of directors. Which metrics would most effectively communicate the security program's effectiveness and improvement needs?

Related Questions

Discussion