Question

A risk analyst is designing a dashboard for the IT operations risk area. Management wants a metric that will warn them before unpatched systems create a significant likelihood of a successful exploit. The analyst must choose which single metric best serves this early-warning purpose and identify who should be accountable for acting on threshold breaches. Which combination is most appropriate?

Accepted Answer

Percentage of critical systems exceeding the patch SLA window, with the first-line IT operations manager accountable for responding to breaches

Answer

Number of patches successfully deployed last month, with the internal audit function accountable for responding to breaches

Answer

Total number of security incidents recorded this quarter, with the risk committee accountable for responding to breaches

Answer

Average time the service desk took to close patch-related tickets, with the CISO accountable for responding to breaches