Certopolis

CompTIA Security+ (SY0-801)

Security audit vs assessment and assessor independence: Security+

An audit is an independent review of records and activities to check compliance with policies and procedures and recommend changes. An assessment is an evidence-based evaluation that informs decisions and prepares for audits, but is separate from them. An assessor is independent when free of any actual or perceived conflict of interest with the system's development, operation or management.

Audit vs assessment

The NIST glossary, citing CNSSI 4009-2022, defines a security audit as an independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures, and to recommend necessary changes. It notes that audit, inspection and assessment are not interchangeable terms.

The same source defines an assessment as an evidence-based evaluation and judgement. Assessments are generally informational, support decision making and inform formal inspections or audits, but are considered separate from them. A pre-audit evaluation that gives management information and issues no formal compliance finding is an assessment.

Assessor independence

NIST SP 800-53A Rev. 5 defines an independent assessor as anyone capable of an impartial assessment. Impartiality means being free of any perceived or actual conflict of interest with the development, operation or management of the system.

Independent assessment does not have to be bought from outside. SP 800-53A says it can come from other elements within the organization or be contracted to an outside entity. An internal team with no role in running the system can be independent. A vendor that hosts and manages the system would be assessing its own work, which is a conflict of interest.

Reusing earlier results

SP 800-53A lets organizations reuse earlier assessment results, but lists factors to check. The longer the time since the last assessment, the less credible and useful its results, because the system or its environment is more likely to have changed.

The degree of independence should also stay consistent. SP 800-53A says it is not appropriate to reuse a self-assessment that required no independence when the current assessment requires more. In that case a new assessment is needed.

Where the exam catches people

  • Believing an assessment and an audit are the same thing: an assessment informs decisions and audits; an audit checks compliance and recommends changes.
  • Believing independence always requires an outside firm: SP 800-53A allows independent assessors from other parts of the organization.
  • Believing the cheapest qualified bidder is fine if it already runs the system: managing the system is a conflict of interest for its assessor.
  • Believing recent results can always be reused: a self-assessment cannot stand in when more independence is now required.
  • Believing old results stay valid if nothing was formally flagged: results lose credibility as time passes and the environment changes.

Written from CompTIA's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. Months before its certification audit, a company commissions an evidence-based evaluation of its controls to inform management's decisions; the evaluation issues no formal finding of compliance. Which of the following engagement types is this?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: B is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    An evaluation that informs management and prepares for a later audit without issuing a compliance finding is an assessment.

    Written from csrc.nist.gov/glossary/term/assessment

  2. A company's policy requires an independent assessment of its payroll system's controls, and the budget is tight. A team in the company's risk office has no role in developing, operating or managing the system. Which of the following engagements best fits?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: D is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The risk office team meets that test, so an internal engagement satisfies the policy without paying an outside firm.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf

  3. A company is choosing a firm to assess the security controls of its HR platform. The lowest bidder already hosts and manages that platform and offers a discount for bundling the assessment with a contract renewal. Which of the following is the primary concern?

    Right. In the game that’s Renown for your Security Program Management and Oversight building.

    Not that one: B is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    A firm that hosts and manages the HR platform would be assessing its own work, which is a conflict of interest.

    Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf