Study ISC2 CISSP Audits and Metrics: key concepts, common traps, and exam decision cues.
On this page
This lesson asks whether you can prove a control works in practice. CISSP usually values durable evidence, meaningful measurements, and review processes that reveal exceptions instead of hiding them.
Evidence-choice map
Requirement
Better first instinct
prove a control operates as intended
test the control and collect evidence of operation
detect suspicious behavior or failures over time
centralized logging and review process
judge whether a metric is useful
tie it to risk reduction or control performance
assess compliance with stated requirements
structured audit against criteria
What the exam is really testing
If the stem says…
Strong reading
“policy exists”
the missing question is whether the control actually operates
“many logs but poor visibility”
log volume is not the same as usable monitoring
“security KPI”
the metric should drive a decision, not just decorate a dashboard
Decision order that usually wins
Ask what claim needs to be proven: compliance, operation, effectiveness, or trend.
Choose the evidence source that actually supports that claim.
Check whether logs, metrics, and audit artifacts are reliable and reviewable.
Tie measurements back to risk, control performance, or decision-making.
Prefer meaningful evidence over attractive but shallow reporting.
CISSP likes evidence that would survive scrutiny. A policy statement, a vendor default, or a noisy dashboard is weaker than tested, reviewed, and attributable proof.
Scenario triage
Scenario
Better first move
management says a control exists
verify operation with testing and evidence
analysts are drowning in logs
improve correlation, prioritization, and review process
KPI dashboard grows but decisions do not improve
redesign metrics to reflect risk and control outcomes
audit must assess adherence to stated requirements
define criteria and gather structured evidence
incident review depends on poor timestamps
fix log quality, time sync, and retention discipline
Common traps
Trap
Better rule
counting activity instead of control effectiveness
metrics should show whether risk is being managed
assuming an audit is the same as a penetration test
audit, assessment, and exploitation answer different questions
collecting logs without time sync, retention, or review discipline