Which measure would best help a board assess whether cybersecurity governance is improving over time?

### Why this is right The discussion asks what measures or performance indicators could evaluate cybersecurity performance. A measure reviewed over time can help leaders assess progress, provided it is connected to the organization's goals and risks. ### The concept A performance measure is information used to assess whether an activity or outcome is meeting an objective. Governance can use measures to support reporting and decision-making, but a measure should be meaningful rather than selected simply because it is easy to count. The material does not prescribe a particular metric or numerical target. ### The other options - **B. A list of security tools with no information about their use or results**: tools alone do not show whether governance outcomes are improving. - **C. The number of company employees who have job titles containing the word security**: titles do not demonstrate risk reduction or effective oversight. - **D. A one-time statement that the company has no remaining cyber risk**: the material treats cybersecurity as ongoing and does not support a claim of zero risk. ### Terms - **Performance measure**: Information used to judge progress toward an objective. ### Remember Choose measures that show progress against objectives, not just activity or tool ownership.