Study. uk . com
  1. Home
  2. All questions
  3. Question 695

CISM study material · question 695 of 1000

How does NIST relate key risk indicators and key performance indicators to metrics generally?

  1. They are the only two valid categories of metric that a measurement programme may collect
  2. They are examples of metrics, though not all metrics fall into either category
  3. They replace metrics entirely once a measurement programme has reached its full maturity
  4. They are alternative names for exactly the same underlying measure of the control's own performance
Show the answer

Answer: B. They are examples of metrics, though not all metrics fall into either category

SP 800-55v1 treats risk and performance indicators as instances of metrics rather than an exhaustive taxonomy; plenty of useful metrics belong to neither.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.4 Metrics

Challenge yourself on this topic → Study as cards