Hundreds of organizations have received their FISASCORE and this allows for good, fact-based comparisons. One of the common questions we receive about information security is "what is everybody else doing?" This question comes from the responsibility for due care/due diligence, liability, and knowing that there's "protection in the herd".