Greatest Concern for Information Security Managers

A.

The use of Key Risk Indicators (KRIs) is a common practice in information security management to track the performance of security controls and identify potential risks. KRIs are quantitative and qualitative measures used to monitor the effectiveness of controls and help identify areas that require improvement. However, if KRIs are not properly defined and managed, they may not be effective in identifying risks and may result in a false sense of security.

Out of the options given, the greatest concern for an information security manager would be A. Undefined thresholds to trigger alerts. KRIs are used to provide early warning signs of potential risks, and thresholds are set to trigger alerts when certain values or thresholds are reached. If thresholds are not defined, it may result in missed opportunities to identify potential risks, which could lead to a security breach. Therefore, the lack of defined thresholds is a significant concern, as it may result in a lack of actionable information and a failure to detect threats in a timely manner.

Option B. Multiple KRIs for a single control process, is not a significant concern as long as the KRIs are well-defined and provide meaningful insights into the effectiveness of the control process. Multiple KRIs may provide a more comprehensive view of the control process, but the focus should be on the quality of the KRIs rather than the quantity.

Option C. Use of qualitative measures, is not a significant concern as long as they are used in conjunction with quantitative measures. Qualitative measures may provide valuable insights into the effectiveness of control processes that cannot be measured quantitatively. However, they should not be used as the sole basis for assessing the effectiveness of control processes.

Option D. Lack of formal KRI approval from IT management, is a concern as it may result in a lack of organizational support for the KRI program. However, it is not the greatest concern as long as the KRIs are well-defined, properly managed, and provide meaningful insights into the effectiveness of control processes. It is important to obtain formal approval from IT management to ensure that the KRI program is aligned with the overall information security strategy of the organization.