Has your organization established documented performance goals for personnel with cybersecurity risk management responsibilities, and do you periodically measure performance against these goals?

This question assesses whether your organization has formalized expectations for cybersecurity personnel and tracks their performance to ensure continuous improvement in risk management activities. Performance goals should be specific, measurable, and aligned with your organization's overall security objectives, such as reducing incident response time, improving vulnerability remediation rates, or enhancing security awareness training effectiveness. Evidence could include documented performance metrics for security team members, periodic performance review templates that include cybersecurity KPIs, dashboards showing security performance trends over time, or improvement plans based on performance measurement results.