A capability assessment finds that an organization has comprehensive security policies and plans. It is very good at identifying security risks, and managing th...