What is a ‘competency framework’? What do you believe are the two (2) most important positive and negative indicators that would be critical for evaluating a security manager?