ABSTRACT
This is one area of the review that will be difficult for an inside security professional to conduct impartially. This is especially true if the person conducting the assessment has had limited experience with other security organizations or other industries. Therefore, if you are an in-house security professional conducting the review, I would strongly recommend that you bring in a consultant for this aspect of the review. If that option is not available, then talk to other security professionals that you network with from other companies and see if you can get one or two of them to meet with you to either assist with this aspect of the review or at least to go over the results of your review and challenge your findings. Whatever you can do to get an objective opinion from outside the organization will be helpful and is, I believe, essential.
