Question 1171 · 1243 in bank
Which of the following metrics would BEST monitor how well information security requirements are incorporated into the change management process?
Show answer
Answer: C
Explanation
C. Denied changes due to insufficient security details. This metric focuses on changes that are denied or rejected specifically because they lack sufficient security details. It indicates that the change management process is actively assessing whether proposed changes adequately address information security requirements. By tracking and monitoring the number of denied changes due to insufficient security details, an organization can gauge the effectiveness of its change management process in ensuring that information security requirements are properly incorporated. If a significant number of changes are being denied or rejected because their security details are insufficient, it suggests that the change management process is effectively considering and enforcing information security requirements. This metric encourages stakeholders to provide the necessary security details when proposing changes, reinforcing the importance of incorporating information security into the change management process.
Source: Adapted from community discussion — koala_lay