security measuring stick

Security should be measure in not how many processes you have set up to protect against security breaches but how your employees act. This is how informed are your employees. If they are put in a situation will they make the right choose? This is how security should be measured. You have to put the responsibility on the people that handle the data; you cannot put all the emphasis on the security system. A truly good secure organization will have competent employees who know how to handle sensitive information and strive to protect it, with the knowledge that they have been provided with by the organization.