A metric shows that only a third of security plans are approved, but nobody can say why. Which remedy does…

Question

A metric shows that only a third of security plans are approved, but nobody can say why. Which remedy does NIST describe?

Accepted Answer

B. Collecting the reasons as a separate metric or as implementation evidence, since one metric rarely explains poor performance — NIST gives exactly this example: determining that the percentage of approved security plans is low is not helpful for correcting it, so information on the reasons must be collected as separate metrics or as implementation evidence.

Answer

Removing the metric because it is not actionable

Answer

Lowering the target until the current rate becomes acceptable, so that the metric stops reporting a shortfall in each reporting period

Answer

Escalating the finding directly to the authorising official, who can then compel the outstanding security plans to be approved at once