An internal auditor reviewing a SaaS provider's secure development lifecycle finds that the team runs static analysis on every pull request but the security manager cannot say whether the programme is actually reducing risk year on year. Which approach would BEST demonstrate the effectiveness of the secure development controls to the audit committee?
- APublish the count of static analysis findings raised each month against each repository.
- BTrack trends in the density of exploitable defects reaching production and the mean time to remediate them. Correct
- CReport the percentage of developers who have completed the annual secure coding training module.
- DProvide screenshots of dashboards showing that every pull request passes the security gate before merging.
Why A is wrong: A raw finding count tells the committee how noisy the tool is, not whether security has improved; rising or falling counts can be driven by tool tuning, code volume, or false positives, so the number alone is not a measure of effectiveness.
Why B is correct: Defect density in production combined with remediation time directly reflects whether the controls are catching real issues earlier and shrinking exposure, which is what an audit committee needs to judge effectiveness over time against an explicit risk appetite.
Why C is wrong: Training completion is an input metric and indicates capability rather than outcome; high completion does not prove that the resulting code is more secure, so it cannot answer the committee's question.
Why D is wrong: Showing that gates run is process evidence and confirms compliance with the workflow, but it does not demonstrate that the controls actually reduce residual risk in production.