Question

A risk manager is designing key risk indicators (KRIs) for the organization's patch management process. The goal is to give management advance warning so they can act before an incident occurs. Which of the following candidate metrics would be the MOST effective KRI for this purpose?

Accepted Answer

The percentage of critical systems exceeding the defined patch deployment deadline

Answer

The number of security incidents caused by unpatched systems in the previous quarter

Answer

The total cost of remediation activities completed after the last breach

Answer

The number of positive audit findings closed during the reporting period