Security Assessment and Testing

Security assessment determines whether the controls implemented to reduce risk have been implemented as designed, are operating as expected, and are achieving the desired result. This assurance can be the result of outside organizations evaluating the control environment or actions taken by the organization itself to evaluate the performance of the controls. The assessment and testing processes must be performed consistently, and the results communicated properly, so that the organization's management understands the risks they could potentially face. Similarly, audit processes should assure external evaluators of the degree to which an organization's controls meet compliance expectations. Ultimately, the results of audit, assessment, and testing activities will allow the organization to identify control gaps and inefficiencies. This information will be the starting point for continual process improvement activities. The security professional should be familiar with the strategies, techniques, and processes by which organizational expectations for controls are set, evaluated, and improved. They should be able to explain the basic flow of audit and assessment activities and describe the tools and artifacts that support data-driven decisionmaking. Collectively, this information should enable the security professional to develop an organizationally appropriate assessment program.