Does your organization regularly review key performance indicators (KPIs) to verify that security policies and procedures are achieving their intended objectives?

Measuring policy effectiveness is the focus here, asking whether you set KPIs for your security policies and procedures and review them to confirm objectives are met. Effective KPIs might include metrics such as percentage of employees completing security training, number of security incidents, mean time to detect/respond to incidents, or compliance rates with specific security controls.

Evidence could include documentation of security KPIs, meeting minutes from security review sessions, dashboards or reports showing KPI tracking over time, and documented actions taken in response to KPI reviews that didn't meet targets.