Question

A risk analyst notices that one of the organization's key risk indicators (KRIs) for failed login attempts has been reporting flat, unchanging values for three consecutive months, even though the security operations team has confirmed multiple brute-force incidents during that period. Before presenting the risk dashboard to the risk committee, what should the analyst do FIRST?

Accepted Answer

Verify the integrity and configuration of the data source feeding the KRI to confirm the values are accurate

Answer

Lower the KRI threshold so future incidents are more likely to trigger an alert

Answer

Replace the KRI with a different indicator that shows more variation

Answer

Present the dashboard as-is and note the discrepancy verbally to the committee