ISOISO 27001Performance EvaluationEASYFree question
A security team reports 'number of awareness emails sent' as a headline ISMS metric to top management each quarter. An auditor flags this as a vanity metric. What characteristic makes it one?
- A.It lacks a target approved by the certification body for the surveillance audit of the awareness programme
- B.It measures activity volume rather than any outcome or change in security behaviour or risk
- C.It is collected by a tool that the auditors have not validated against the sampling plan in the audit programme
- D.It is a lagging indicator owned by the legal department of the company
Why B is correct
A vanity metric counts effort or output that looks impressive but says nothing about effectiveness. Emails sent does not reveal whether awareness improved or phishing susceptibility fell; an outcome measure such as phishing click-through rate would be more meaningful.
Know someone studying for ISO 27001? Send them this one.