Information Systems Security Architecture Professional (ISSAP) Practice Exam

Security performance metrics quantify how well security controls operate, focusing on how quickly threats are detected, how fast responses happen, and how effectively incidents are managed. Mean Time to Detect measures, on average, how long it takes for security teams to identify that an incident is occurring after it begins. This directly reflects the efficiency and effectiveness of monitoring, alerting, and detection capabilities, making it a clear example of a security performance metric. The other options aren’t about how security operations perform. The number of new hires is an HR staffing metric, not a measure of security effectiveness. Changing a website’s color scheme relates to branding or UI design, not security performance. The number of security cameras purchased is a procurement or asset-count metric, not a measure of how security processes detect or respond to threats. So, the best fit for a security performance metric is the measure that captures detection speed.