The interview process can be very challenging and is best handled by trained specialists. The team leader and the personnel conducting the interviews must have strong interpersonal and interview skills. The interview is truly a fine art. The worst kind of interview is one in which you feel that you are being interrogated by the Grand Inquisitor who is digging for information and will get it, even if torture is required. That is not the purpose of the IAM assessment process. The purpose is a cooperative assessment effort in which the customer feels just as much a part of the assessment process as the assessment team.

The interview process is the single most important action taken during the onsite phase of the IAM. This is where the assessment team will discern the actual vs. perceived security posture of the customer. Many organizations have a security policy and may have implemented certain aspects of a good security policy. The interview process will help identify the true security posture of the organization as opposed to what is written or what the customer thinks is implemented. This perspective is critical to establish the organization s true security posture. The interview process will give the assessment team additional insight into the operations of the customer s organization. Surprisingly, the assessment process will also give the customer insight into their operations of which they might not have been aware.