Question

A newly appointed CISO has operated the information security governance program for one year. The board now asks for evidence that governance itself—not just individual controls—is effective and delivering value. Which of the following would BEST demonstrate the effectiveness of the governance program to the board?

Accepted Answer

Evidence that security objectives are consistently aligned with and traceable to enterprise strategic goals, supported by key goal indicators

Answer

A report showing the percentage of security incidents resolved within the defined service-level targets over the past year

Answer

A summary of firewall rule changes, patch deployment rates, and vulnerability scan results across the environment

Answer

Confirmation that the security team completed all planned security awareness training sessions on schedule