Question

An information security manager compiles monthly KRI data showing that failed patch-deployment rates have steadily risen over three consecutive reporting cycles, though no individual threshold has yet been breached. Before the next executive risk committee meeting, what is the MOST important action the manager should take?

Accepted Answer

Analyze the upward trend, correlate it to affected risk scenarios, and report the deteriorating condition to the committee

Answer

Wait until a KRI threshold is formally breached before escalating the metric to the committee

Answer

Lower the KRI threshold so the current values register as a breach requiring immediate action

Answer

Replace the failed patch-deployment KRI with a lagging indicator that is easier to interpret