Assessment of Security Controls
Purpose and methods
Assessment determines whether controls are implemented correctly, operating as intended, and producing the desired outcome. Candidates should know the three assessment methods: examine, interview, and test. Assessment procedures provide objectives and methods for each control, and assessors produce findings with severity and evidence. Independence matters: the assessor should not be the person who implemented the control.
Findings and reporting
Results feed the security assessment report, which documents findings, risk, and recommendations. A key concept is the distinction between a control that is satisfied, one that is partially satisfied, and one that is not satisfied. Findings should be traceable to evidence, and the report informs the authorization decision rather than making it.
Traps to watch
A frequent trap is treating assessment as a compliance checklist divorced from risk. Another is assuming a passed assessment means no residual risk. Candidates also confuse assessment with continuous monitoring; assessment is a point-in-time evaluation, while monitoring is ongoing. Watch for questions that let the implementer self-certify without independent review.
Rule of thumb
Assess against the control objective, not the wording of the implementation. Worked example: a control requires logging of privileged activity. The team logs activity but never reviews it. The assessor interviews staff, examines logs, and tests review records, finding no reviews. The control is not satisfied because the objective, detecting misuse, is unmet even though logging exists.