RESPONSIVE SUPPORT SUMMARY The auditor provides assistance for any immediate action needed (spot training, tool fixes, consulting on upcoming projects) -- this may also involve addressing vulnerabilities that triggered an incident response. PURPOSE In-audit activities and training are used to increase an organization's agency to seek out and address immediate security challenges within their organization, as well as enabling the organization to securely receive and store the audit report. THE FLOW OF INFORMATION Information Threats Actors Results Activity Threats Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities Responsive Support Information Flow GUIDING QUESTIONS Are there any critical vulnerabilities or remediation activities that the organization needs a deeper understanding to give proper weight to in the report? How can you prepare the staff and management for aspects of the audit process might lead to alienation or inhibit the process? What is the organization's readiness and likelihood to succeed in engaging with security technology? What factors will complicate or inhibit the effective and safe uptake and use? Is the support you want to provide (troubleshooting, fixes, upgrades, training, etc.) critical to the security of the organization? If not, can you provide that support without taking away from the audit? Will you have the capacity to support software or hardware that you provided while providing support? APPROACHES Targeted Training: Educational components can be introduced in order to cover the digital security basics, satisfy the team's expectations and motivate the target group to include digital security practices in their everyday lives. Targeted Support: The auditor can provide small targeted technical/policy development support where there expertise overlaps and the audit time-line allows. Page 161 of 240