ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Complexity is a security metric that expresses the level of effort required both for an attacker to successfully exploit a vulnerability and for developers or operations staff to implement an effective fix. Tracking complexity helps the organization understand which issues may demand specialized skills, longer development time, or additional resources, and therefore may require different prioritization or mitigation strategies. Criticality level describes potential business impact, average remediation time measures speed of fixing but not inherent difficulty, and KPIs are broader program-level indicators that may aggregate many different figures-including complexity-but are not themselves a measure of exploit or remediation difficulty.