"...what kind of "tools to support information security .."? I'm interested because technology is not everything, security is more a mind set than technology."

Great question!

I think it is important to remember tools are not synonymous with technology. I do not view all tools as being technology-based. Tools have been around since humans started fashioning arrowheads from stones and started digging holes with sticks. Tools comprise a very wide range of items that we can use to make our life easier and/or more efficient. I've been using non-technology-based tools for a very long time; both at work and away from work.

For example, I use a hoe in my garden to get rid of weeds; it is an effective tool that is not technology-based. I use a wall calendar with columns for me and each of my family members as a tool to keep track of what we each need to do and where we need to be on any given day. One of my favorite tools is the screwdriver I need to use at least once a month to tighten a screw in the arm of my office chair that, for some reason, always gets loose no matter how tightly I screw it in.

Although in my business I work with primarily technology issues, I use a very wide number of non-technology-based tools to help me make my work more effective. For example, I view my to-do list (a hand-written list) as an effective tool to keep me on track each day with my work. I also have always used my favorite pen and good ol' spiral bound notebook as my tools of choice to take notes during meetings; I remember the details better when I write them down by hand instead of typing it on my computer...there is a ton of scientific research that shows how these two different ways of taking notes impacts different parts of your brain and memory, but that is a topic for another blog... :)

The tools I'm creating are management tools that may involve technology to some degree but are not in-and-of-themselves technology; at the core they help information security, privacy and compliance leaders to more effectively and efficiently perform their job responsibilities. They go beyond a to-do list, but they are not a technology solution. I have always believed that information security and privacy is a human issue that must be addressed using not just technology, but also tools that involve human actions, activities, decisions, and so on.

This is really a great and important question; too many people today automatically equate business tools purely with technology. Technology is wonderful, and can address many business issues. However, with very few, if any, exceptions, non-technology tools will always be needed to make business as successful and as efficient as possible.