What value does a pay-for-Is it still working? Do we still need it? people icons discussing Last week's discussion started us looking at the design of policies for cybersecurity and information assurance, and how we translate those into implementation and action. Let's take the "after-action" view of policy creation, and look at what it takes to make sure that such policy is still worth it. You might want to tackle this from different perspectives, as you continue the discussion: How do we detect when our policies are obsolete or no longer relevant? What role does change leadership play in ensuring that "constant vigilance" also has "constant diligence" associated with it? What kind of costs and impacts are associated with these three (or four) dues when they get out of balance with each other? Are our systems and processes helping us to stay compliant and meet all legal, regulatory, and contractual obligations? Do our processes help us meet all of our reporting needs? compensation plan offer an organization? In which situations might a pay-for-performance compensation plan not create value for an organization? What type of employee might benefit from a pay-for-performance plan? Which type of employee is not suited for pay-for-performance