Security Metrics, KRIs, and Dashboards
Key Takeaways
Subdomain 2.4 covers key metrics, Key Risk Indicators (KRI), and dashboards, scorecards, and reports.
A metric measures a security activity or result; a KRI signals that exposure to risk is rising before harm occurs.
A measurement nobody acts on is only a number, so every metric needs an owner and a target.
A clean metric can coexist with a worsening KRI, so read the measurements together.
Source: ISC2 CC Exam Outline v01/2026, subdomain 2.4, and the ISC2 CC outline page, checked 2026-10-22.
Measuring Effectiveness in the 2026 Outline
Subdomain 2.4, Measure cybersecurity effectiveness, lists two topics: key metrics and Key Risk Indicators (KRI), and dashboards, scorecards, and reports. The question behind both is direct: how do you show that security controls are working?
Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 2.4, checked 2026-10-22.
Metrics and KRIs Are Not the Same
A metric is a measurement of a security activity or result, such as the share of access reviews completed on time. A Key Risk Indicator (KRI) is a measurement that signals rising exposure before an incident happens, such as a growing number of accounts with no owner. Both are useful. The difference is purpose: a metric shows performance, and a KRI warns about exposure.
Good measurements are tied to a control or goal, are collected the same way each time, and have someone responsible for acting on them. A measurement nobody acts on is only a number.
Dashboards, Scorecards, and Reports
The outline names three ways to present measurements:
- Dashboards show current values at a glance for the people who act on them.
- Scorecards compare results against targets over time.
- Reports explain results and decisions to leaders, auditors, or the board, with the context a number needs.
The same measurement can serve every audience with different detail. A dashboard might show a handful of KRIs; a report explains what changed and what is being done about it.
Scenario: The Green Dashboard
A dashboard shows every patch metric in green, but the KRI for systems without an owner has risen for three months. A clean metric can hide growing risk. The response is to pair the metric with the KRI, ask what the number does not measure, and assign an owner to the unowned systems.
For the exam, the signal to notice is a KRI moving in the wrong direction while a metric looks healthy.
What distinguishes a Key Risk Indicator (KRI) from an ordinary security metric?
A KRI warns that exposure to risk is rising, while a metric measures a security activity or result
A KRI is always a financial value and a metric is always a percentage, so the two can be told apart by their units
A KRI replaces the need for dashboards and reports, since a single indicator summarizes the whole security program
A KRI is only used after an incident has been closed, as a review of what happened during the event
Which of these are ways the outline names for presenting cybersecurity effectiveness? Select all that apply.
Select all that apply
Dashboards
Scorecards
Reports
Firewall rule sets
Hardware warranty certificates
Sections you finish are checked off in the contents.