Quizz

3/27/23, 10:41 PM KGIs, KPIs, and KRIs | CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019

https://learning.oreilly.com/videos/cism-certification-domain/9781838987923/9781838987923-video3_8/ 1/2

KGIs, KPIs, and KRIs

whatever measures we have in place that after the fact, important

00:15 / 02:31

Quality

Speed

Auto - 1080p

Normal

DescriptionTranscription

Topics Start Learning Search 50,000+ courses, events, titles, … What's New

3/27/23, 10:41 PM KGIs, KPIs, and KRIs | CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019

https://learning.oreilly.com/videos/cism-certification-domain/9781838987923/9781838987923-video3_8/ 2/2

KGI's, KPI's and KRI's for the certification definitely know each of these, what they are and what

they're not. Key Goal Indicators. With KGI's we define whatever measures we have in place that after

the fact, important caveat here is this is after, that can tell management how well as specific IT

process achieved its business requirements. In project management this would be a look back.

When we started out this project or this plan we had very clearly defined parameters for what

success looked like. If we do this, then we're successful if we do it within this budget and this time

frame we have done what we need to do. This is a look back to confirm that, and if not, why? What

was it that went wrong? What can we do next time to improve the outcome? This should not be

used to lay blame but to improve our processes and our workflows and how we do things. So next

time we would have a better result. And then KPI's Key Performance Indicators. How well we're doing

on one specific task. And there is a direct correlation between the goal and the performance. The

goal is the overarching the whole thing. The KPI is the specific and this in a lot more detail. And we

use KPI's across our entire organization. For a hospital it can be how many admissions do we have?

How long is the length of stay on average? Or if we're a company that does phone sales, how well

does this person sell on that day versus the rest of the team? How long do they use on the phone for

supports? We have all those to see if we're meeting our targets or not and I'm assuming a lot of you

are used to using them. KRI's on the other hand is much more IT security Key Risk Indicators. We use

those to quantify and demonstrate the risks that our organization to be facing or how risky a certain

activity is. And they are also used to measure how well we adhere to the risk appetite their

organization has. It can even help us establish it, and we will talk more later about risk appetite. We

can also use the KRI's as an early warning system where we identify a potential event that can harm

the continuity of our activities or a specific project. If we choose to ignore it that is risk rejection, and

that is never okay, we would go in we'll do our due diligence we'll research how much of a problem

with this potentially be and then determined by analysis we would build in more security measures

or discontinue the activity and all of this we'll cover later.