Which measurement does NIST say demonstrates that staff can actually recognise and report a potential security event, which completion rates cannot show?

Question

Answer 1

Show the answer

Answer: A. Metrics on incident reporting by employees

SP 800-50r1 lists metrics on incident reporting that demonstrate employee ability to recognise and report potential cybersecurity events among the quantitative learning programme data.

Source: NIST SP 800-50 Rev. 1 (NIST) — Sec. 2.4.1.1 Quantitative Measurements