Assessment/Audit of Security and Privacy Controls
The assessment domain tests the independent evaluation of controls and the quality of evidence behind each conclusion. The Security Control Assessor (SCA) must be independent of the system owner and implementers, and reports findings to the AO.
How assessments are built
NIST SP 800-53A supplies, for each control, assessment objectives, potential evidence, and methods. The three methods are examine, interview, and test; a credible assessment mixes them, because a screenshot (examine) does not prove an account is disabled (test). The assessment plan defines scope, sampling, schedule, and rules of engagement. Results go into the Security Assessment Report (SAR), which states whether each control is satisfied or other than satisfied, the basis for that conclusion, and the risk posed by gaps. Findings feed the POA&M.
Worked example
For AC-2 (account management): examine the account management procedure and a current account inventory; interview the administrator about how access requests are approved and how terminated users are removed; test by sampling accounts, including a recently departed employee, and verifying disablement within the required timeframe. If policy says 24 hours but one account stayed active for nine days, the control is other than satisfied no matter how good the procedure reads.
Evidence discipline
- Test the instance you claim, in the environment you claim, at the time claimed.
- Record sample size and selection method so conclusions can be defended.
- Distinguish a documentation gap from an operating failure; they carry different risk.
- Do not let the implementer write the assessor's conclusion.
Traps that cost marks
- Concluding "compliant" from a policy review alone.
- Sampling only the friendliest accounts or systems.
- Treating assessment as an audit of paperwork rather than a test of effectiveness.
- Failing to rate findings, leaving the AO unable to weigh residual risk.