Which method can provide a better return on IT security investment and provide a thorough and comprehensive assessment of organizational security covering polic...