← VCE Data Analytics U4O2

Proposing evaluation criteria for security effectiveness

Measurable standards, such as incidents per year or recovery time, used to judge how well a security strategy meets its goals and protects confidentiality, integrity and availability.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 36, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 60

Understanding Proposing evaluation criteria for security effectiveness in VCE Data Analytics U4O2

What it does: Counting unauthorised access to records judges how well the strategy keeps data private, which is confidentiality. A measurable criterion has a number or target, so you can check the strategy against it. 'Reasonably secure' cannot be measured. Integrity is about data being accurate, correct and trustworthy, so error rates in records are a good measure. Backup locations relate to availability and recovery. Criteria should link to the organisation's goals. A count of breaches directly shows whether patient privacy is protected. Staff opinion does not. Criteria are standards used to judge a strategy. They do not replace controls such as firewalls or backups.

Common mistakes: An evaluation criterion must be measurable. 'Be more secure' cannot be counted or compared. It should be a measurable standard such as 'Criterion: breaches per year'. 'Restore quickly' is vague and has no unit. A criterion needs a measurable value, such as restore time in hours, so the strategy can be judged against the target.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Proposing evaluation criteria for security effectiveness to a class →

This module's key terms are also in a printable crossword (Modules 26–43) and word search (Modules 1–43).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which is a measurable evaluation criterion for a security strategy?
The system should be reasonably secureFewer than 2 security incidents per year
Matches
Criterion: The system should be very secure
↓
It is vague and not measurable. There is no number, time period or target, so the strategy cannot be judged against it.
Applying
Meanings
Term
evaluation criteria
Meaning
Measurable standards, such as incidents per year or recovery time, used to judge how well a security strategy meets its goals and protects confidentiality, integrity and availability.
Practice
Confidentiality: 0 unauthorised accesses to customer data per year
Testing
Gaps
Criterion: Breaches per <= 2
Check Answer
Spots
1Criterion: be more secure
2Target: 2 or fewer

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Constellation Wolf' badge — Space Legend, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which is a measurable evaluation criterion for a security strategy?
A. The system should be reasonably secure
B. Fewer than 2 security incidents per year ✓
A measurable criterion has a number or target, so you can check the strategy against it. 'Reasonably secure' cannot be measured.
2. Which criterion best measures AVAILABILITY?
A. Systems are restored within 4 hours of an outage ✓
B. Only staff with approval can open payroll files
Recovery time shows how quickly data and systems are usable again, which is availability. Restricting access to approved staff is confidentiality.
3. Which criterion best measures CONFIDENTIALITY?
A. No unauthorised access to customer records in 12 months ✓
B. Website uptime of 99.9 percent
Confidentiality is about stopping unauthorised access or disclosure. Uptime measures availability.
4. Which criterion best measures INTEGRITY?
A. Backups are stored in two locations
B. Fewer than 0.5 percent of records fail accuracy checks ✓
Integrity is about data being accurate, correct and trustworthy, so error rates in records are a good measure. Backup locations relate to availability and recovery.
5. A hospital sets the goal of keeping patient data private. Which criterion judges the strategy against that goal?
A. Zero privacy breaches of patient records per year ✓
B. Staff must like the new security software
Criteria should link to the organisation's goals. A count of breaches directly shows whether patient privacy is protected. Staff opinion does not.

Match the Pairs

Fewer than 5 security incidents per year → A measurable evaluation criterion that sets a clear target for how often incidents may occur
Systems restored within 4 hours of an outage → A measurable evaluation criterion for availability that sets a maximum recovery time
A criterion linked to confidentiality: it measures unauthorised access to private data → Zero unauthorised accesses to customer records per year
A criterion linked to integrity: it measures how accurate and unaltered the data is → At least 99.5% of records pass accuracy checks each month
Criterion: The system should be very secure → It is vague and not measurable. There is no number, time period or target, so the strategy cannot be judged against it.
Criterion: Install a new firewall by June → This is an action or task, not a standard. It says what to do but not how to measure whether the strategy is working or meets organisational goals.

Key Term

evaluation criteria
Measurable standards, such as incidents per year or recovery time, used to judge how well a security strategy meets its goals and protects confidentiality, integrity and availability.

Fill in the Blanks

1. Criterion: Breaches per year <= 2
Hint: Type the time period that makes this target measurable.
2. Criterion: Data entry errors <= 1% Links to: Integrity
Hint: Type the CIA principle about data staying accurate and unaltered.
3. Criterion: Unauthorised access = 0 a year Links to: Confidentiality
Hint: Type the CIA principle about keeping data from people who should not see it.
4. Criterion: Recovery time <= 4 hours Links to: Availability
Hint: Type the CIA principle about data and systems being accessible when needed.
5. incidents = 3 target = 2 IF incidents <= target: "Met"
Hint: Type the comparison operator that checks the result is at or below the target.

Spot the Error

Question 1
A Criterion: be more secure
B Target: 2 or fewer
C CIA link: confidentiality
Line A — An evaluation criterion must be measurable. 'Be more secure' cannot be counted or compared. It should be a measurable standard such as 'Criterion: breaches per year'.
Question 2
A Criterion: restore quickly
B Target: under 4 hours
C CIA link: availability
Line A — 'Restore quickly' is vague and has no unit. A criterion needs a measurable value, such as restore time in hours, so the strategy can be judged against the target.
Question 3
A Criterion: uptime percentage
B Target: at least 99.9%
C CIA link: confidentiality
Line C — Uptime measures whether systems and data can be accessed when needed, so it links to availability, not confidentiality.
Question 4
A Criterion: record error rate
B Target: above 1% of records
C CIA link: integrity
Line B — An error rate target should be an upper limit. Aiming for more than 1% errors would reduce data integrity. It should be 'below 1% of records'.
Question 5
A Goal: protect customer records
B Criterion: unauthorised logins
C Target: zero per quarter
D CIA link: availability
Line D — Unauthorised logins measure whether people who should not see the data can get to it. That is confidentiality, not availability.

Student with a class code? Join your class →