Assessment of Security Controls
Assessment purpose and methods
Assessment determines whether selected controls are implemented correctly, operating as intended, and producing the desired outcome. SP 800-53A provides assessment objectives and procedures. Assessors use three methods: examine (review documents, configurations, logs), interview (talk to responsible personnel), and test (exercise the control). A security control assessor (SCA) plans the assessment, samples where appropriate, records evidence, and produces a security assessment report (SAR) with findings and risk ratings.
Independence and coverage
Assessor independence is a recurring theme: the person or team that implemented a control should not be the sole assessor of it. The assessment should cover common, hybrid, and system-specific controls, including inherited controls at the provider level. Coverage must be justified; sampling is acceptable when representative and documented. The SAR feeds the authorization package and supports the AO's risk decision.
Traps
A vulnerability scan is not a complete control assessment; it is one type of test evidence. A documentation review alone cannot prove a control operates. Assessment is against the selected and tailored control set, not automatically against a full baseline. Also, assessment is not authorization-the SCA does not grant an ATO.
Worked example
For account management, the assessor examines the account policy, interviews the account administrator, and tests a sample of new, modified, and terminated accounts. Findings are recorded with evidence and severity. Rule of thumb: triangulate examine, interview, and test; write down what you actually observed.