Question

A risk manager is preparing a monthly dashboard for the operations leadership team. The team wants to understand both whether a critical patch-management control is operating as designed and whether the exposure it addresses is increasing. Which pairing of metrics BEST satisfies both needs on the same dashboard?

Accepted Answer

Percentage of systems patched within SLA (KPI) alongside the number of unpatched systems with known exploited vulnerabilities (KRI)

Answer

Number of patches released by vendors this month and total help-desk tickets logged

Answer

Percentage of systems patched within SLA and average time to close help-desk tickets

Answer

Number of unpatched systems with known exploited vulnerabilities and count of change requests submitted