Assessment/Audit of Security and Privacy Controls
Assessment produces evidence, not opinions
Assessment determines whether implemented controls meet their objectives, using NIST SP 800-53A procedures: assessment objectives, methods (examine, interview, test), and objects of assessment. Methods are combined - examine alone rarely proves a control works; examining the policy plus interviewing the operator plus testing a sample is stronger. Sampling is legitimate when the population is large, but the sample must be justified and documented, and depth and coverage scale with impact level. Outputs include the assessment plan, the security assessment report, and updates to the plan of action and milestones. Assessors must be independent of the system they assess; self-assessment supports continuous monitoring but does not substitute for independent assessment for authorization.
Traps
Findings are not "pass/fail"; results are satisfied or other than satisfied, with supporting evidence. A POA&M entry is a remediation record, not a finding. Confusing assessment with audit is common: audits check conformity to a standard or regulation, assessments check control effectiveness against objectives. Another trap is letting the system owner assess their own system for an authorization decision.
Rule of thumb
A credible finding has three parts: what was required, what was observed, and the evidence connecting them. If any part is missing, the finding is an opinion.
Worked example
An assessor reviews access requests and finds three of twenty samples with no record of manager approval. The finding states the requirement (documented authorization before access), the observation (3 of 20 lacked evidence), and the evidence (ticket IDs). Remediation goes to the POA&M with an owner and date.