2. How much confidence do I have?
How confident are you in terms of your people, process(es), and technology? Are people in the right positions for their skill sets? Are your processes decreasing value while increasing workload? Is your technology paying off as expected?
Broader, consider your capabilities and confidence in terms of prevention, detection, and response. How confident are you in your current preventative controls? Why?
In the event prevention is bypassed, would you notice? How quickly would you detect it? How accurate is your response?
Ultimately, the shift to ‘assume breach’ is an opportunity to make improvements. Change up the the training and roles of people. Create and update processes. Evaluate and change technology.