What part of an organization’s strategic risk assessment MOST likely includes information on items affecting the success of the organization?

Key Performance Indicators (KPIs) are quantifiable metrics used to evaluate how effectively an organization is achieving its key business objectives. In the context of a strategic risk assessment, KPIs define what organizational success looks like. The assessment then evaluates risks based on their potential to negatively impact these KPIs. Therefore, the KPIs themselves are the part of the assessment framework that contains direct information on the items affecting and measuring the success of the organization. They are lagging indicators that measure performance against strategic goals.

1. (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

9th Edition. Chapple

M.

Stewart

J. M.

& Gibson

D. (2021).

Page 41

Chapter 1: "Key performance indicators (KPIs) are used to measure the success of a security program... KPIs are lagging indicators because they measure the results of a security program after the fact." This directly links KPIs to measuring success. In contrast

the same page defines KRIs as "forward-looking metrics that are used to identify and track potential risks."

2. NIST Special Publication 800-55 Revision 1

"Performance Measurement Guide for Information Security." (2008).

Section 2.2

Page 2-2: "Performance measures should be selected to provide information on the results of information security activities as they relate to the organization’s mission and business goals." This establishes that performance measures (of which KPIs are a primary type) are directly tied to the success of achieving organizational goals.

3. ISACA

"COBIT 2019 Framework: Introduction and Methodology." (2018).

Section 4.2

Page 27: Discusses the "goals cascade

" which translates stakeholder needs into specific

actionable

and measurable enterprise goals. The metrics associated with these goals function as KPIs

providing a clear measure of success in achieving strategic objectives.