The evaluation of Security Management process performance identifies areas that need improvement; such as the foundation and interfaces of the process, activity definitions, key performance metrics, the state of supporting automation, as well as the roles and responsibilities and skills required. Insights and lessons learned from direct observation and data collected on process performance are the basis for improvement recommendations.