Question

A risk manager is designing the monitoring dashboard for a payment processing platform. The IT operations team wants to include a metric that tracks the percentage of patches applied within the mandated 30-day window, arguing it demonstrates how well the control is functioning. The risk manager wants a separate metric that provides an early warning that unpatched systems could soon lead to a security breach. Which combination BEST reflects the correct use of these two metrics?

Accepted Answer

The patching-within-window percentage is a key performance indicator (KPI), and the number of high-severity unpatched systems past the deadline is a key risk indicator (KRI)

Answer

Both metrics are key risk indicators (KRIs) because they both relate to security patching risk

Answer

The patching-within-window percentage is a key risk indicator (KRI), and the number of unpatched systems is a key performance indicator (KPI)

Answer

Both metrics are key performance indicators (KPIs) because they both measure the operations team's effectiveness