Have senior leaders established and agreed upon measurable cybersecurity objectives that are used to manage risk and evaluate performance?

This question assesses whether the organization's leadership has a unified approach to cybersecurity with clear, measurable objectives that drive risk management decisions and performance evaluation. When senior leaders agree on cybersecurity objectives, it ensures consistent prioritization, resource allocation, and accountability throughout the organization. These objectives should be specific enough to measure progress and effectiveness of the security program. Evidence could include board meeting minutes discussing cybersecurity objectives, a formal document outlining agreed-upon security metrics and KPIs, executive dashboards showing security performance against objectives, or risk management frameworks that incorporate these objectives into decision-making processes.