Who Should Measure the Effectiveness of Information System Security Related Controls in an Organization?

C.

It is the systems auditor that should lead the effort to ensure that the security controls are in place and effective.

The audit would verify that the controls comply with polices, procedures, laws, and regulations where applicable.

The findings would provide these to senior management.

The following answers are incorrect: the local security specialist.

Is incorrect because an independent review should take place by a third party.

The security specialist might offer mitigation strategies but it is the auditor that would ensure the effectiveness of the controls the business manager.

Is incorrect because the business manager would be responsible that the controls are in place, but it is the auditor that would ensure the effectiveness of the controls.

the central security manager.

Is incorrect because the central security manager would be responsible for implementing the controls, but it is the auditor that is responsibe for ensuring their effectiveness.

The effectiveness of information system security-related controls in an organization should be measured by the central security manager. The central security manager is responsible for overseeing the organization's overall security posture and ensuring that security policies and procedures are implemented and enforced.

Measuring the effectiveness of security controls involves evaluating whether they are achieving their intended objectives and providing the desired level of protection for the organization's assets. This can involve conducting regular assessments of the organization's security posture, reviewing security logs and incident reports, and analyzing security-related metrics and key performance indicators.

While local security specialists and business managers may have a role in implementing and enforcing security controls, they typically do not have the broad perspective and authority needed to measure their effectiveness across the organization. Systems auditors may be involved in evaluating security controls as part of an audit engagement, but their primary focus is on assessing compliance with regulatory and industry standards rather than evaluating the effectiveness of controls from a risk management perspective.

Therefore, the central security manager is the most appropriate person to measure the effectiveness of information system security-related controls in an organization, as they have the expertise, authority, and organizational perspective needed to assess and manage security risks across the enterprise.