Which of the following is true about a security metric program's measurement method?

• A. Measurement methods should be clearly defined and repeatable.
• B. Measurement methods can be informal and ad hoc.
• C. Only qualitative statements are allowed.
• D. Measurement methods are optional.

Answer: (A)

The measurement method in a security metric program must be clearly defined and repeatable. When you define exactly what is measured, where the data comes from, how often you collect it, how you normalize and calculate results, you create a recipe that anyone can follow. This makes the results objective and consistent over time, so you can trust trends, compare performance across periods, and audit or verify the numbers if needed. If the method is informal or ad hoc, different people or teams might collect data in different ways, leading to inconsistent results and undermining confidence in the metrics. Metrics can be qualitative or quantitative, but both require a clear procedure to be meaningful and comparable. Measurement methods aren’t optional—the program hinges on having a repeatable approach.