Lesson 9 of 10 · About 4 minutes
Test a security control
Learn the concept.
A policy describes what should happen. A control test asks whether the process actually met that expectation in a defined scope.
Turn a requirement into a test
Follow the sequence, or move one step at a time.
Reduced motion is on. Use Next step to explore without animation.
Read all 4 steps
- Define the expected result
Our fictional policy sets the removal deadline.
- Choose a documented sample
Record the system, period, selection method, and evidence sources.
- Compare actual outcomes
The fifth removal was late. Keep the supporting records and calculate against the policy.
- Report a bounded finding
Report one late case among the five sampled, assign follow-up, and state sampling limits.
Requirement, evidence, conclusion
A fictional training example. Compare the observation with the conclusion.
- Requirement
Remove access within one business day.
- Evidence
Five sampled departures: four on time, one late.
- Conclusion
One exception in the sample. Investigate and document scope.
Read the visualA team provides its access-removal policy. Does that prove timely removal?
A written requirement explains the expected behavior. You still need evidence of actual operation.
Define the claim
Choose the requirement, system, period, population, and expected result before inspecting evidence. Make the test repeatable.
Match evidence to the question
Examine records, interview the people responsible, or perform an authorized test as appropriate. A screenshot of a setting and a record of an actual outcome answer different questions.
Report the limits
Record the sample, method, exceptions, and missing evidence. A passing sample supports a bounded conclusion; it does not prove every case passed.
Put it in context
Fictional policy: remove departed staff access within one business day. You sample five departures and compare trusted departure dates with access-removal records. Four met the deadline; one was late. Report four of five sampled cases on time, document the late case, and ask the owner to investigate. Do not mark the whole control effective just because a written policy exists.
Make a decision.
Use what you just learned. A correct answer lets you save this lesson to your progress.
Take this with you.
State the expected result, test it, and keep the conclusion within the evidence.
Next lesson: Handle a security exception