1. What is the role of policy in formulating the information assurance manual?
2. Why is it useful to have a template for documenting the information assurance system?
3. Operational controls are important to security - what purpose do they serve?
4. Why is it necessary to follow a hierarchical decomposition process to define information assurance procedures?
5. Why do the various types of information in the system have to be described? What outcome does this activity support?
6. What is the reason why the security applications have to be specifically identified in the process of security system formulation?
7. What are infrastructures composed of? What purpose do they serve?
8. What is the role of the configuration management process? What other type of function does it serve?
9. Why is it hard to secure information? Why are concrete procedures necessary?
10. What is the purpose of the estimate of operational status? Why is this an important element of real-World security system formulation?