Which of the following would BEST assist an information security manager in measuring the
existing level of development of security processes against their desired state?

A.
Security audit reports

B.
Balanced scorecard

C.
Capability maturity model (CMM)

D.
Systems and business security architecture

Explanation:

The capability maturity model (CMM) grades each defined area of security processes on a scale of
0 to 5 based on their maturity, and is commonly used by entities to measure their existing state
and then determine the desired one. Security audit reports offer a limited view of the current state
of security. Balanced scorecard is a document that enables management to measure the
implementation of their strategy and assists in its translation into action. Systems and business
security architecture explain the security architecture of an entity in terms of business strategy,
objectives, relationships, risks, constraints and enablers, and provides a business-driven and
business-focused view of security architecture.