Domain 3 · Objective reference 3A5 · Chapter 17 of 35
Design program metrics before reporting
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Measure the decision you need to make.
Explore the anchors
Define an audience and decision.
Concept matching activity
Match this task or description to its concept:
Set numerator denominator source and period.
Choose a concept before checking the explanation.
Metric denominator sandbox
A fictional review has 100 in-scope controls. Change how many were tested and how many passed. The pass rate among tested controls is different from coverage of the whole population.
Testing coverage: 40%. Pass rate among tested controls: 75%. Untested controls: 60.
A 100% pass rate on a small tested sample does not prove the untested controls work. State the period, sampling method, evidence quality and population.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Build a chain of reasoning
Management concept and decision mechanism
Start with the management question and intended decision, then choose a measure. Define the population, period, source, denominator, target, collection owner and limitations. Separate activity, service performance, risk exposure and control effectiveness. Counting alerts closed can obscure poor triage, while measuring restored services against tested objectives addresses a different outcome. Do not change definitions retrospectively to make results look successful. Validate automated data and explain breaks in time series. Metrics should support prioritization and improvement rather than reward concealment of failures.
Build a chain of reasoning
Connect the objective to a risk scenario, then to a desired outcome, a funded initiative, an accountable owner, and evidence of progress. For example: expand digital sales; a compromised administrator could interrupt ordering; limit privileged access and recover service reliably; fund access reviews and recovery exercises; assign business and technology owners; report review coverage and demonstrated recovery results.
A useful measure answers a decision question. A count of alerts closed describes activity. The proportion of critical services meeting tested recovery objectives tells leadership more about resilience. Both can be useful, but they serve different audiences. State the period, population, target, source, and limitations of every reported measure.
Worked example
An awareness program tracks participation separately from verified payment callbacks and the time suspicious reports take to reach analysts.
Check your understanding
Why can the same increasing count have opposite interpretations?
Show explanation
Higher reporting or broader monitoring can increase observations even when security behavior improves; context and definitions determine meaning.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.