Which practice supports continuous improvement in POA through data analysis?

• A. Monitoring and trend analysis
• B. Isolating data to IT only
• C. Relying on annual audits
• D. Ignoring analytics

Answer: (A)

Continuous improvement in POA relies on data-driven decision making, using metrics gathered over time to guide actions. Monitoring and trend analysis provides ongoing visibility into how security controls perform, tracks changes, and reveals patterns that indicate whether current practices are effective or need adjustment. With this data, you can compare against baselines and objectives, assess the impact of changes, and iterate to close gaps, fueling a true PDCA-style cycle of improvement.

Isolating data to IT only limits cross-functional insight and deprives the program of broader perspectives needed to improve security outcomes. Relying on annual audits gives only a snapshot and can miss changing conditions, delaying learning and response. Ignoring analytics removes the primary source of evidence for making informed improvements.