CAPACITY ASSESSMENT SUMMARY In this component the auditor engages with staff through interviews and conversations to identify the organization's strengths and weakness (expertise, finance, willingness to learn, staff time, etc.) to adopting new digital and physical security practices. The auditor uses this information to modify the audit scope and recommendations accordingly. PURPOSE Knowing an organization's strengths and weaknesses allows the auditor to provide more tailored recommendations that an organization will be more likely to attempt and achieve. The auditor will use this assessment in preparing for the audit itself as well as when evaluating the difficulty of a recommendation. This information also provides a starting place for understanding the organization's current use and understanding of technology, digital security, and current threat landscape, as well as revealing elements of an organization's workflow, infrastructure and even vulnerabilities that you might otherwise have overlooked. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Vulnerabilities Vulnerabilities Barriers Barriers Assets Assets Audit Preparation Information Flow GUIDING QUESTIONS What is the organization's ability to adopt new technologies or practices? What resources does the organization have available to them? What is the environment that the organization works within like? What barriers, threat actors, and other aspects influence their work? Are there any specific considerations for the audit that would require modifying the overall approach, tools, preparation steps, or timeline? APPROACHES Conduct pre-audit interviews with key managerial and technical staff to identify organizational areas of strength and weakness (expertise, finance, staff time, etc.). Have informal conversations with staff during the course of the audit to further gather capacity and historical "stories" of technology adoption. OUTPUTS Page 29 of 240