Which metric best measures the speed of remediation for security issues?

• A. Number of training hours completed.
• B. Internal audit findings resolved.
• C. Supplier BPQ updates.
• D. Corrective action closure time.

Answer: (D)

Speed of remediation is captured most accurately by corrective action closure time. This metric measures the elapsed time from when a security issue is identified (and a corrective action is initiated) to when that action is fully closed and verified as complete. It directly reflects how quickly the organization can move from discovery to resolution, helping spot delays in approvals, resources, or processes so risk is reduced sooner. Training hours indicate readiness, not how fast issues are fixed; supplier BPQ updates show supplier status, not remediation pace; internal audit findings resolved tracks outcomes rather than the speed of closing actions.