This research benchmark provides insight and recommendations for all organizations that are compelled to manage, audit, and report on security related systems and information for purposes of demonstrating compliance with industry regulations, government regulations, industry standards and best practices, or internal policies. By doing so on a more consistent and repeatable basis, Best-in-Class organizations have demonstrated their ability to lower operational costs, support higher scale, reduce security risks, and maintain consistent policies for security and compliance.