point in time security assessments or security performance management that is more continuous / automated - which do you prefer ? Check out this paper by Ed Amoroso - retired ATT Chief Security Officer - founder of TAG Cyber https://www.tag-cyber.com/analysis/white-papers/requirements-for-security-performance-management
I plan to rely on static annual external assessments of security to judge effectiveness70%
I plan to look at security performance management capabilities to assess continuously my security effectiveness29%
254 PARTICIPANTS
Unfortunately the link is broken