Security Control Assessment and Assurance

What a security control assessment decides and how this course teaches it: determinations and their reasons, the evidence pack, the seven assessment templates, and one control taken from its clause to a draft finding. Start here.

What an assessment can conclude, settled before the evidence is read: criteria, design and operating effectiveness, assessment against audit, the limits of assurance, objectivity, the SP 800-53A procedure, and the assessment brief. Exercise: the MFA coverage figure.

Turning a brief into a scoped plan: business services and their systems, boundaries, the assessment period, dependencies and inherited controls, criteria, stakeholders, and assembling the plan. Exercise: scope the finance access assessment.

Turning criteria into a control test matrix: determination statements, observable conditions, test procedures, acceptance criteria, vague tests, tests for different kinds of control, and the matrix. Exercise: the vulnerability management matrix.

Judging the evidence that arrives: sufficiency and appropriateness, relevance, reliability and provenance, completeness, timestamps, the weaker forms, and contradictions, assembled in an evidence register. Exercise: the vulnerability submission.

Choosing a method, interviews and walkthroughs, then populations, selection, sample size and failures, after PCAOB AS 2201 and AS 2315. Tool: the Sample Planner. Exercise: the operational sampling and testing plan.

Testing the six clauses of an access standard on their whole populations: leavers, privileged and emergency access, service accounts, an access review, exceptions and compensating controls, and the identity ledger. Tool: the Assessment Workpaper. Exercise: MFA.

Testing operational controls on their whole populations: scanning coverage, logging, endpoint protection, change, backup and recovery, and incident response exercises. Tools: the Population Bench and the Assessment Workpaper. Exercise: remediation.

Assessing the evidence for outside dependencies: SOC 2 reports, their periods and carve-outs, complementary user entity controls, cloud tenant configuration and the evidence-gap analysis. Tools: the Evidence Rater and the Assessment Workpaper.

Turning determinations into findings another assessor can reproduce: condition, criteria and scope, consequence and compensating controls, cause where supported, severity with its rationale, and validation with owners. Tools: Evidence Questions and Design Review.

Following findings to their close: corrective actions, interim measures and compensating controls, risk acceptance, closure evidence, and retesting on a later period. Tools: Test Writer and the Assessment Workpaper. Exercise: retest the leaver control.

Turning findings into the assurance report: conclusions the evidence supports, limitations, management disagreement and escalation, reports for different readers, and assembling the report. Tools: Evidence Questions and Design Review. Model report download.

One sheet per area of assessment work: the question, the record to request, the test, what to read in the result and what it does not prove.

Nine runbooks, one per stage of an assessment, each with the template it fills, what every column takes, and a completed example.

The workspace for the course: the evidence packs and their index, a spreadsheet set up for dates and business days, checking what each file covers, and a verification that fails loudly.

Four assessment cases worked end to end on the evidence pack, including the wrong turns, each ending in a determination, a finding and the point that transfers.

Eight situations that arise during fieldwork and need handling the same day, each with prerequisites, a pre-flight, a time budget, the sequence and three outcomes.

Every exercise and practice-tool scenario in the course, by module, with the lesson each one sits in, and the course exam.

The sources the course cites, grouped by part of the course, each with the lessons that cite it.

Security Control Assessment and Assurance end-of-course exam: 40 questions in five parts, from planning an assessment to reporting it, ending on a case study.