Question

An information security manager wants to demonstrate whether the organization's security program is improving over time as new capabilities are implemented. Executive leadership has asked for a way to track the program's progress consistently across annual budget cycles. Which of the following would BEST support this objective?

Accepted Answer

A capability maturity model measured against defined target maturity levels

Answer

The number of security incidents reported to the help desk each quarter

Answer

The percentage of the security budget spent relative to the approved allocation

Answer

The count of vulnerabilities remediated during each patching window