Question 1: Do you believe that security control testing is a requirement for every organization? Why or why not?
Question 2: What aspect of security control testing, if any, do you believe is more important than the other? Are they all equally important?
Question 3: Is security control testing the same in every country globally? Is it allowed in every country around the world? Which countries, if any, regulate which types of security controls you can or cannot have, and/or how you test them, if at all?