Security control assessment

A security control assessment is a structured evaluation of whether an organisation’s controls are implemented correctly, operating as intended, and producing the outcome required of them. NIST SP 800-53A, the companion guide to the NIST SP 800-53 control catalogue, sets out three assessment methods: examine, which inspects documents, settings and records; interview, which questions the people who operate the control; and test, which exercises the control and observes what it does. Most assessments combine all three, because each carries a blind spot the other two cover.

Two parameters decide how much weight a result carries. Depth is how thoroughly a single control is examined, and coverage is how many instances are examined. Both are declared in the assessment plan, and an assessment that samples too narrowly cannot support the conclusion it reports. The output is advisory: strengths, weaknesses, findings tied to named controls, and recommendations the organisation may act on. That advisory character is what separates it from a security audit, which measures controls against a named standard and issues a formal opinion for whoever commissioned it. It is also broader than a vulnerability assessment, which scans for weaknesses rather than judging whether a control meets its objective, or penetration testing, which sets out to prove that a weakness is exploitable.

Exam relevance: tested in CISSP Domain 6, where a scenario is likely to turn on which method produced the evidence. Reading a document or a configuration is examine rather than test, and conformance on paper is not evidence of behaviour. If the deliverable is a recommendation the organisation may accept or decline, the activity is an assessment; if it is a formal opinion measured against a named standard, it is an audit. Assessments are also expected to weigh privacy alongside security, which is worth remembering when only the security objective appears among the options.