Collecting security process data: account management, management review, KPIs and KRIs, backup verification, training, DR/BC

Technical tests show whether a firewall or an application is sound, but many security failures are process failures: accounts never removed, backups that cannot be restored, training nobody completed. Collecting security process data means gathering evidence about how well administrative and operational processes actually work. That evidence lets management make informed decisions, lets auditors verify controls, and lets the security team see where the program is drifting before an incident exposes it.