FOLLOW UP SUMMARY This component allows an auditor to explain and get feedback on their report as well as evaluate the success of the process over time through a continued relationship with the host. This component consists of the final meeting with the host and following up with them after a period of a few months to see if they need further assistance, are willing to share their experience working with any of the recommended resources, or as new resources are identified. PURPOSE Follow up can be a valuable tool for encouraging an organization to continue their digital security process. But, follow up needs to be desired by an organization and achievable for the auditor. As such, follow up must be minimally intrusive on both the auditor and the host's time. THE FLOW OF INFORMATION Information Threats Actors Results Activity Threats Actors Capacity Capacity Activities Activities Vulnerabilities Vulnerabilities Barriers Barriers Assets Assets Information Flow GUIDING QUESTIONS What are the barriers the organization faced in implementing the recommended risk mitigation plan? Are there new resources that the auditor can provide to supplement the original audit? What can you do to make your follow up perceived as additional support instead of as an evaluation of their success? APPROACHES Staff Feedback Survey: Receive feedback from the staff on the execution of the audit. Report Follow Up Meeting: Have a follow-up call to discuss report. Making Introductions: Introduce organization to known resources as needed. Long-Term Follow Up: Contact host after a few months to check on progress, get long-term feedback and connect with any new resources. Page 166 of 240