Key control indicators (KCIs) are metrics that provide information on the extent to which a given control is meeting its intended objectives in terms of loss prevention, reduction, etc. In order to provide such information, the control effectiveness indicator has to have an explicit relationship to both the specific control and to the specific risk against which the control has been implemented1. Therefore, the best source for identifying KCIs is to use controls mapped to organizational risk scenarios, which can help define the control objectives, the expectedoutcomes, and the relevant indicators for each risk scenario. This approach can also help align the KCIs with the organizational goals and strategy, and enable the monitoring and reporting of the control effectiveness23.
The other options are not the best sources for identifying KCIs, because:
Privileged user activity monitoring controls are specific types of controls that aim to prevent unauthorized access or misuse of sensitive data or systems by privileged users. They are not a sourcefor identifying KCIs, but rather a possible subject of KCIs. For example, a KCI for this type of control could be the number of privileged user accounts that have not been reviewed or revoked within a specified period4.
Recent audit findings of control weaknesses are useful for identifying the gaps or deficiencies in the existing control environment, and for recommending corrective actions or improvements. However, they are not a source for identifying KCIs, but rather an input for evaluating or revising the existing KCIs. For example, if an audit finding reveals that a control is not operating as intended, or that a KCI is not providing reliable or timely information, then the control or the KCI may need to be modified or replaced5.
A list of critical security processes is a high-level overview of the key activities or functions that are essential for maintaining the security of the organization’s assets and information. It is not a source for identifying KCIs, but rather a starting point for defining the control objectives and requirements. For example, a critical security process could be incident response, which requires a set of controls to ensure the timely and effective detection, containment, analysis, and recovery of security incidents. The KCIs for this process could be the number of incidents detected, the average time to resolve incidents, or the percentage of incidents that resulted in data breaches6.
References =
Key Control Indicator (KCI) - CIO Wiki
How to Develop Key Control Indicators to Improve Security Risk Monitoring - Gartner
Indicators - Program Evaluation - CDC
Privileged User Monitoring: What Is It and Why Is It Important? - LogRhythm
Internal Audit Key Performance Indicators (KPIs) - AuditBoard
Hierarchy of Controls - NIOSH - CDC
