Assurance has been defined as “the degree of confidence that security needs are satisfied”[2]. The problem with this definition is that, unless one has a way to specify security needs in some measurable way, assurance can not be expressed in a measurable way either. The definition leaves the practitioner with the challenge of determining what “security needs” are, whether or not they have been ...