What does NIST 800-55 Security Metric Guide provide?

• A. Security Metric Guide for information technology systems provides guidance on how an organization uses metrics, identifies the adequacy of in-place security controls, policies and procedures
• B. A framework for incident response team
• C. A standard for cryptographic algorithms
• D. A policy for personnel background checks

Answer: (A)

Measuring security effectiveness through metrics is the core idea. NIST 800-55 Security Metrics Guide for Information Technology Systems provides guidance on how an organization uses metrics to assess security controls, policies, and procedures, including how to select meaningful metrics, collect and analyze data, establish baselines, and interpret results to determine the adequacy of in-place protections. This helps support risk management and ongoing improvement by turning security performance into actionable information for decision-makers. It isn’t about incident response frameworks, cryptographic algorithm standards, or personnel background-check policies, which are addressed by other guidelines and policies.