Security metrics are regularly reviewed and reported to leadership
Reviewing agreed security indicators with leadership on schedule is management oversight, feeding the same risk picture an independent reviewer later examines. That routine reporting rhythm does not substitute for the independent review A.5.35 requires, so the link stays at related rather than supports.
This process control produces security indicators on schedule and reviews them with leadership, giving managers the data to see whether their teams follow policy.