Executive management's primary responsibility is strategic oversight, focusing on whether the information security program effectively manages risk and aligns with business objectives. A security metrics dashboard is designed to translate complex, technical data into a high-level, visual summary of performance. It provides trends and key performance indicators (KPIs) that directly answer the executive question: "Is our investment in security delivering the desired outcome and effectively reducing risk?" This holistic view of program effectiveness is precisely the level of insight required for strategic decision-making and governance, unlike more granular operational metrics.

B. This is a specific, comparative metric. While useful for context, it is only one component used to evaluate the broader concern of overall program effectiveness.
C. This is a budget input metric. Executives are more concerned with the results and value (effectiveness) derived from the budget, not the raw number of hours allocated.
D. This is a highly technical, operational metric relevant to security analysts for tuning systems. It is too granular and not a direct strategic concern for executive management. ---

1. ISACA, CISA Review Manual, 27th Edition. Domain 2: Governance and Management of IT, Section 2.6 IT Performance Monitoring and Reporting. This section emphasizes that reporting to senior management should focus on key goal indicators (KGIs) and key performance indicators (KPIs) that demonstrate the achievement of business objectives, which is a measure of overall effectiveness.

2. ISACA, COBIT 2019 Framework: A Governance and Management Guide. The goals cascade model illustrates how high-level stakeholder needs are translated into enterprise goals and then into specific metrics. The framework's monitoring processes, such as MEA01 (Managed Performance and Conformance Monitoring), are designed to provide stakeholders with information on the extent to which objectives are being achieved, directly addressing program effectiveness.

3. Jaquith, A. R. (2007). Security Metrics: Replacing Fear, Uncertainty, and Doubt. Addison-Wesley Professional. Chapter 1, "The Problem with Security Metrics," highlights that executives need metrics that answer fundamental questions about the security posture, such as "How secure are we?" and "Is our security spending effective?", which are directly related to the overall effectiveness of the security program.