Susan sends an email to Paul. Who determines the meaning and the value of information in this email?

A couple of years ago you started your company which has now grown from 1 to 20 employees. Your companys information is worth more and more and gone are the days when you could keep it all in hand yourself. You are aware that you have to take measures, but what should they be? You hire a consultant who advises you to start with a qualitative risk analysis. What is a qualitative risk analysis?

You are the owner of the SpeeDelivery courier service. Last year you had a firewall installed. You now discover that no maintenance has been performed since the installation. What is the biggest risk because of this?

Midwest Insurance controls access to its offices with a passkey system. We call this a preventive measure. What are some other measures?

Some security measures are optional. Other security measures must always be implemented.
Which measure(s) must always be implemented?