Initial click rates and credential entry

Reporting rates for suspicious activity

Effectiveness of existing security awareness training

Response procedures and escalation

Physical security controls and procedures