Under what assumptions do we use to provide the number of hours that will be used for the security policy reviews? Do we ensure to not add features when theyre not needed and contribute to the insecurity/fragility of the whole system? Is there an up-to-date information security awareness and training program in place for all system users? Are the appropriate level of information security and service delivery in line with the 3rd party service delivery agreements? What are the success criteria that will indicate that Security objectives have been met and the benefits delivered? Defining, designing, creating, and implementing a process to solve a challenge or meet an objective is the most valuable role... In EVERY group, company, organization and department.Unless you are talking a one-time, single-use project, there should be a process. Whether that process is managed and implemented by humans, AI, or a combination of the two, it needs to be designed by someone with a complex enough perspective to ask the right questions. Someone capable of asking the right questions and step back and say, 'What are we really trying to accomplish here? And is there a different way to look at it?'This Self-Assessment empowers people to do just that - whether their title is entrepreneur, manager, consultant, (Vice-)President, CxO etc... - they are the people who rule the future. They are the person who asks the right questions to make Security investments work better. This Security All-I...