2 cissp ® Official Study Guide Eighth Edition

664
Chapter 15 
■
Security Assessment and Testing
Security Assessments
Security assessments
are comprehensive reviews of the security of a system, application, 
or other tested environment. During a security assessment, a trained information security 
professional performs a risk assessment that identifies vulnerabilities in the tested envi-
ronment that may allow a compromise and makes recommendations for remediation, as 
needed.
Security assessments normally include the use of security testing tools but go beyond 
automated scanning and manual penetration tests. They also include a thoughtful 
review of the threat environment, current and future risks, and the value of the targeted 
environment.
The main work product of a security assessment is normally an assessment report 
addressed to management that contains the results of the assessment in nontechnical lan-
guage and concludes with specific recommendations for improving the security of the tested 
environment.
Assessments may be conducted by an internal team, or they may be outsourced to a 
third-party assessment team with specific expertise in the areas being assessed.
nIST SP 800-53A
The National Institute for Standards and Technology (NIST) offers a special publication 
that describes best practices in conducting security and privacy assessments. NIST Spe-
cial Publication 800-53A: Assessing Security and Privacy Controls in Federal Information 
Systems and Organizations is available for download:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf
Under NIST 800-53A, assessments include four components.
■
Specifications are the documents associated with the system being audited. Speci-
fications generally include policies, procedures, requirements, specifications, and 
designs.
■
Mechanisms are the controls used within an information system to meet the specifi-
cations. Mechanisms may be based in hardware, software, or firmware.
■
Activities are the actions carried out by people within an information system. These 
may include performing backups, exporting log files, or reviewing account histories.
■
Individuals are the people who implement specifications, mechanisms, and
activities.
When conducting an assessment, assessors may examine any of the four components 
listed here. They may also interview individuals and perform direct tests to determine the 
effectiveness of controls.

---

Building a Security Assessment and Testing Program