A board asks whether the security program is improving over time. Which evidence is most useful?

1. Consistent outcome measures tied to objectives and interpreted with changing exposure
2. The number of new tools regardless of effectiveness
3. A single favorable month's incident count
4. Only the total program budget