A system, comprising: a memory configured to store network-related security policies and procedures associated with an enterprise, wherein the security policies and procedures comprise policy information identifying actions associated with protecting assets of the enterprise and procedure information identifying actions to be performed by personnel associated with protecting assets of the enterprise; a display; and at least one device configured to: monitor enterprise activity associated with a plurality of the enterprise's networked devices in accordance with the security policies and procedures stored in the memory, wherein the monitoring includes monitoring actions associated with the policy information and monitoring actions to be performed by the personnel associated with the procedure information, determine, based on the monitored enterprise activity, whether the enterprise is complying with the security policies and procedures stored in the memory including the actions associated with the policy information and the actions to be performed by the personnel associated with the procedure information, calculate a risk exposure metric for a plurality of the assets of the enterprise based on the monitored enterprise activity and whether the enterprise is complying with the stored security policies and procedures including the stored policy information and the stored procedure information, output, to the display, a graphical user interface, GUI, providing information identifying the risk exposure metric associated with each of the plurality of assets, and receive, via the GUI, a plan identifying actions to be taken to reduce the risk exposure metric, wherein the plan is based on a user-selected risk exposure metric or a risk exposure metric recommended by the system. a memory configured to store network-related security policies and procedures associated with an enterprise, wherein the security policies and procedures comprise policy information identifying actions associated with protecting assets of the enterprise and procedure information identifying actions to be performed by personnel associated with protecting assets of the enterprise; a display; and at least one device configured to: monitor enterprise activity associated with a plurality of the enterprise's networked devices in accordance with the security policies and procedures stored in the memory, wherein the monitoring includes monitoring actions associated with the policy information and monitoring actions to be performed by the personnel associated with the procedure information, determine, based on the monitored enterprise activity, whether the enterprise is complying with the security policies and procedures stored in the memory including the actions associated with the policy information and the actions to be performed by the personnel associated with the procedure information, calculate a risk exposure metric for a plurality of the assets of the enterprise based on the monitored enterprise activity and whether the enterprise is complying with the stored security policies and procedures including the stored policy information and the stored procedure information, output, to the display, a graphical user interface, GUI, providing information identifying the risk exposure metric associated with each of the plurality of assets, and receive, via the GUI, a plan identifying actions to be taken to reduce the risk exposure metric, wherein the plan is based on a user-selected risk exposure metric or a risk exposure metric recommended by the system. monitor enterprise activity associated with a plurality of the enterprise's networked devices in accordance with the security policies and procedures stored in the memory, wherein the monitoring includes monitoring actions associated with the policy information and monitoring actions to be performed by the personnel associated with the procedure information, determine, based on the monitored enterprise activity, whether the enterprise is complying with the security policies and procedures stored in the memory including the actions associated with the policy information and the actions to be performed by the personnel associated with the procedure information, calculate a risk exposure metric for a plurality of the assets of the enterprise based on the monitored enterprise activity and whether the enterprise is complying with the stored security policies and procedures including the stored policy information and the stored procedure information, output, to the display, a graphical user interface, GUI, providing information identifying the risk exposure metric associated with each of the plurality of assets, and receive, via the GUI, a plan identifying actions to be taken to reduce the risk exposure metric, wherein the plan is based on a user-selected risk exposure metric or a risk exposure metric recommended by the system.