Question

An information security manager collects the raw count of security incidents from each of five business units and presents them to the steering committee. A committee member objects that the largest business unit always appears the 'worst' simply because it has more employees and systems, making it impossible to fairly compare unit performance. What should the security manager do to make the incident metric more meaningful for comparison?

Accepted Answer

Normalize the incident counts against a common denominator such as incidents per 1,000 endpoints or per employee for each unit

Answer

Report only the total enterprise incident count and stop breaking it down by business unit

Answer

Exclude the largest business unit from the report to avoid skewing the comparison

Answer

Replace the incident count with the total security budget allocated to each business unit