The auditor checks staff devices for updated systems and software, anti-virus and other security capabilities, and identifies software runing on computers and its current version. The auditor checks for known vulnerabilities to any out of date software. This is used to develop a report component exposing how un-updated software can lead to large vulnerabilities. Overview Integrated with other activities/interactions, interview staff on their usage of technology and remote services Materials Needed Considerations Communicate with the staff members the level of confidentiality you are treating discussions around their device and technology usage with - i.e. explain what incident response triggers you have agreed upon with the organization, and that anything not triggering that is to be only reported in aggregate. Walkthrough As you work with staff members (this pairs well with the device checklist activity), also interview them about the other devices they use, and how they connect to work services email/webmail, intra/extranet tools, Constituent Relationship Management (CRM) tools like CiviCRM or Salesforce, financial tracking tools, and website management tools. Phone Usage Work Email Work Calls Chat Apps with partners/work related User Software and Tools Page 74 of 240