Does your organization regularly review key performance indicators (KPIs) to verify that security policies and procedures are achieving their intended objectives?

This question assesses whether your organization has established measurable metrics to evaluate the effectiveness of security policies and procedures, and whether these metrics are regularly reviewed to ensure objectives are being met. Effective KPIs might include metrics such as percentage of employees completing security training, number of security incidents, mean time to detect/respond to incidents, or compliance rates with specific security controls. Evidence could include documentation of security KPIs, meeting minutes from security review sessions, dashboards or reports showing KPI tracking over time, and documented actions taken in response to KPI reviews that didn't meet targets.