Which practice best ensures ongoing measurement of security control effectiveness?

• A. Reactive incident response plans that wait for a breach to occur.
• B. Auditing and reviewing incident histories only after major incidents.
• C. Regular testing against objectives, metrics, audits, and review of incident histories.
• D. Relying solely on automated alerts without validation.

Answer: (C)

Continuous, evidence-based measurement of security control effectiveness relies on regularly testing against defined objectives and metrics, conducting audits, and reviewing past incident histories. This approach provides ongoing visibility into how well controls perform in real-world conditions, detects gaps early, and guides timely improvements, rather than waiting for a breach to reveal problems. Reactive incident response plans delay learning and remediation; auditing only after major incidents misses evolving risks; relying solely on automated alerts without validation can create a false sense of security and fails to prove that controls meet defined objectives. By integrating regular testing, metrics, audits, and analysis of incident histories, an organization maintains an ongoing evidence base to assess and improve security control effectiveness.