How can I tell if my security measures are sufficient?

“A realistic assessment is always made in the context of existing systems and risks — not based on abstract best practices.”