
190 ◾ The Security Risk Assessment Handbook
© 2011 by Taylor & Francis Group, LLC
assessment, security review, coordination and promotion, and program updates. If
the organization has few processes, the team should switch to a more open-ended
interview that allows the interviewee to describe the current processes by walking
through training, the budgeting process, and how new security controls are selected
and implemented.
Table6.17 Security Operations Interview Guideline
Objective Subtopic Suggested Questions
Determine
existence and
adequacy of
security
controls within
the system
development
environment
System
operations
• What types of changes ...