Security metrics allow a company to know if it is improving in its implementation of policies.

• A. TRUE
• B. FALSE
• C. Not sure
• D. Depends on the metrics used

Answer: (A)

Security metrics quantify how well policy implementations are functioning. By defining metrics that map to policy goals, you can establish baselines and track performance over time, spotting trends that show improvement or decline. For example, fewer policy violations, faster remediation, higher device and user compliance, more audit findings closed, or smoother incident response all indicate that policies are being implemented more effectively. Because metrics provide objective evidence, they let a company determine whether its policy implementation is genuinely improving. Of course, this hinges on selecting appropriate, reliable metrics and data, but the fundamental idea is that good metrics reveal progress.