Study. uk . com
  1. Home
  2. All questions
  3. Question 415

CISM study material · question 415 of 1000

Why does NIST place senior management support as the foundation of a security metrics programme rather than as one contributor among many?

  1. Regulators require formal executive sign-off on all published security metrics before any one of them may be used in a management report
  2. Without proactive support from those who control resources, the programme fails under political pressure and budget limitation
  3. Senior managers are the only permitted audience for security metrics, since the figures would simply be misread further down the organisation
  4. Senior managers must personally validate each metric
Show the answer

Answer: B. Without proactive support from those who control resources, the programme fails under political pressure and budget limitation

SP 800-100 warns that where those who control information resources do not actively back the programme, politics and tight budgets are enough to undo it. Support is the base, not a contributor.

Source: NIST SP 800-100 (NIST) — Ch. 7 Performance Measures

Challenge yourself on this topic → Study as cards