What metrics are we trying to improve/change with this project quantify success?
Why are we pursuing this outcome now and not before?
What broader business strategy is this initiative tied to (security, compliance, cyber insurance, zero trust, operational excellence, etc.)?
What management KPI (Key Performance Indicators) does this project support?
Which business unit is driving this program/project?
How is this security risk being graded in terms of level of operational risk (negligible, low, medium, high, severe, very severe)?
How is this security risk being graded in terms of inherent probability (very unlikely, unlikely, likely, very likely, almost certain, certain)?
What is ...