Use the appropriate tool to assess organizational security