A security control has strong design but insufficient staffing to operate it consistently. What should the practitioner assess?

1. Whether operating capacity supports the claimed effectiveness
2. Only whether the policy uses mandatory language
3. The design as conclusive proof of full protection
4. Automatic closure because a procedure exists