In my courses on the management of information assurance (IA) I make a point of telling my students that as managers, we should always be prepared to answer the following two questions from upper ...