Technology Capacity Assessment

Example: Reporting on the volume of support requests, uptime, pending projects, or performance and status of IT resources is given.

Example: Optimally, IT staff verify and update the documentation periodically for network diagrams, credential management, vendor lists, and inventory lists.

Example: Which accounts are created when new staff come in, how access is revoked and information is protected when staff leave, the timeframe of when onboarding/offboarding requests must be made, and when staff leave, data or accounts are transferred to the appropriate stakeholder.

A Project Lead is a single individual who is accountable for a project from beginning to end. This need not be the same person for every project that is implemented in the organization.

Having a defined project management process can include the use of a tool, such as Asana or Basecamp. 

Change management refers to the process of managing the people-side of change in order to achieve a successful implementation. 

Training is offered to staff on a regular basis as scheduled sessions or on-demand services. Training is given with larger-scale system changes such as program updates or product changes.

There is a formalized system for support requests either via a ticketing system, support email or other processes.

Especially important for mission-critical hardware such as servers, firewalls and mission-critical software. 

Backup systems should be both physically and logically distinct from primary systems. For example, if sensitive data exists on an in-house server, the backup should be offsite and on a separate system (such as a cloud-based backup). Restores should also be performed, at a minimum, once every three months (quarterly). 

Unified Threat Management (UTM) monitors inbound and outbound network traffic for malware and signs of intrusion or attempted intrusion. Only applies to organizations with networks used by multiple staff. Not applicable to organizations that are completely distributed. 

A Data Leader for an organization takes ownership for leading the organization toward being data-driven. This role includes helping various departments and staff better understand their systems and their data and how it can inform decision-making. A Database Administrator can fulfill this role, especially if they perform a leadership function for the organization or regularly interact with leadership.

Optimally, data systems and sources are reviewed annually to keep the inventory up-to-date. 

For example, the organization works to break down silos between departments and information within departments and encourages working collaboratively to select systems and integrate different systems where appropriate. 

The organization maintains central oversight on all sources of data. This includes any systems or personal processes (e.g. spreadsheets) that may be exist alongside any central systems. Data collection forms are developed to ensure that required data is gathered in the correct format, and that a central system serves as a "single source of truth" for the organization.

Staff are able to access up-to-date data and reports on a self-service basis. Staff do not rely on exports that are generated and then provided in an external format (e.g. Excel).

Staff have been involved in a process of identifying KPI (key performance indicators) by which their progress in their specific areas can be measured. KPIs are used by staff to track progress as well as indicate when a process may need to change.

Staff view data as an organizational resource. People responsible for entering data understand the importance of reliable data, and have an understanding of how data fits into the "bigger picture" of the organization's success.

Leaders and staff engaging in conversations about data and seek to learn and adapt based on insights gained from data. Data insights become a means of conducting "small experiments" to test assumptions or re-engineer existing processes.

A cybersecurity risk assessment looks at threats to confidentiality, integrity and availability of information managed by the organization, and compares these threats against the in-place safeguards to determine which risks to expend effort on mitigating. Threat modeling looks at specific threats to the organization that may be unique based on culture, nature of work, or other criteria. 

An effective cybersecurity plan is done annually, at a minimum, and includes a timeline for implementation of any changes, a plan for communicating and supporting the change and support for new security measures. 

There is an ongoing security awareness training program in place for staff to help them with best practices for information security.

Cyber liability insurance can help mitigate financial risk and provide additional resources should your organization suffer a breach or other cybersecurity-related incident. 

Vulnerability scanning is software which scans computers, networks and applications for weaknesses.

An effective incident response plan includes, at a minimum:

1. Guidelines for declaration of an incident and activation of the incident response
2. A defined incident response team with contact information
3. A communications plan
4. A recovery plan
5. Lessons learned and changes 

Some examples of Password Management and SSO systems include LastPass, 1Password, Okta & OneLogin. 

Ideally, a patch management solution that addresses Windows and Macs, servers, desktops and laptops and also handles third-party applications such as Adobe, Java & MS Office. 

Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication. 

Example: communication practices are strategically integrated and central to organizational planning. If you do not have a communications plan, please select 1 from the scale.

Example: Staff can easily add/edit/delete page content, pictures, videos, and add/remove entire pages as needed.

Example: Social media channels are considered and selected thoughtfully, and there are clear guidelines for using organizational versus personal social media accounts.

Example: Organizations who get the most out of their social media data regularly gather and evaluate the data, and then review and reflect on the data, and adjust their strategy as necessary in accordance with the findings. 

Example: Opt-in and opt-out guidelines are followed.  The sender of the email is indicated clearly. A valid physical address of the sender is posted, and the subject line of the email accurately represents the contents of the email. 

Example: List recipients are tagged as "donors", "volunteers", "event attendees", etc. or with specific issue tags.

Example: The organization tracks open rates on their emails and knows what type of content best engages their various constituents.