Assessment/Audit of Security and Privacy Controls
Three related but distinct activities
Assessment evaluates whether controls are designed and operating effectively against stated criteria. Audit is a formal, independent examination, often against an external standard. Continuous monitoring supplies ongoing data between assessments. None of them is authorization - assessment informs, the authorizing official decides.
Choose the right method
- Examine - review documents, configurations, logs, and artifacts.
- Interview - question people who perform or oversee the control.
- Test - exercise the mechanism, including technical testing and sampling of transactions.
Match method to control type. Trap: assessing a technical control by interview alone, or accepting a policy document as proof that a control operates.
Independence and evidence quality
Assessors should be independent of the team that implemented the controls - this is why internal audit reports to the board and why the three lines of defense exist. Evidence must be sufficient, relevant, authentic, and timely. Sampling introduces risk; state the sample basis and population.
Outputs
The assessment plan, the assessment report, findings rated by severity and risk, POA&M entries for gaps, and a recommendation to the authorizing official. Distinguish a deficiency in one control from a system-level failure - the official weighs the totality.
Traps: letting the implementer "sign off" their own control as tested; confusing severity with risk; recommending authorization rather than reporting results.
Rule of thumb: every finding should cite the criterion, the evidence, and the conclusion. If the criterion is not named, the statement is an opinion, not an assessment result.
Track remediation from findings in the same register used for risk, so assessment results feed the risk picture.