Security control assessor

A control assessor takes a stated control — retention is immutable, privileged access is reviewed quarterly, logging covers every production host — and establishes whether it holds in the estate as built. The work is a test plan, a sample, an artifact and a rating, in that order. The failure mode of the role is accepting an assertion: a screenshot of a policy page is not evidence that the control operated. Assessors are judged on whether their findings survive contest, and on whether the next assessor can reproduce them from the working papers alone.

• ·Translate a control statement into a testable assertion with a defined population and sample.
• ·Test design and operating effectiveness separately, and say which one failed.
• ·Collect artifacts that are dated, attributable and reproducible — not narrated.
• ·Rate findings by real risk to the business, not by how easy they were to spot.
• ·Track remediation to closure and re-test rather than accepting a plan as a fix.
• ·Keep working papers an external auditor or regulator can follow without you in the room.

1. 09:00Scope and sampling
   Pick the population for this quarter's privileged-access review test and defend the sample size before pulling a single record.
2. 10:30Evidence collection
   Request artifacts from the control owner. Half of what arrives proves the policy exists rather than that it ran; send those back with the specific question restated.
3. 13:00Control testing
   Run the destructive-action test against the backup repository. It is blocked — record what blocked it, not simply that it failed.
4. 14:30Finding write-up
   One gap: snapshot deletion is unblocked for production admins. Write the condition, the criterion, the cause, the effect and the recommendation, with the artifact attached.
5. 16:00Owner walkthrough
   Walk the finding with its owner. Disagreement is normal; the assessment holds if the evidence does.

• Control testing that produces evidence

  Design and operating effectiveness tested separately, with artifacts a third party can re-run.

  cmp-101cmp-102sec-101sec-102
• Detection and logging assurance

  Prove a monitoring control collects, matches and notifies, rather than trusting that the rule exists.

  dr-101dr-102dr-103
• Recovery and continuity assurance

  Test whether the backup estate survives an attacker with backup-admin rights, and report the unmitigated gaps.

  ran-101
• Finding quality and defensibility

  Condition, criterion, cause, effect, recommendation — rated on business risk and able to survive contest.

  cmp-201cmp-301

• GRC platforms and control registers
• Evidence stores, ticketing and sampling tooling
• SIEM and logging consoles, for coverage testing
• Backup and identity admin consoles, for control tests
• Frameworks: NIST SP 800-53, ISO 27001, SOC 2, PCI DSS, CIS Controls

What separates a good analyst

• Asks for the artifact rather than the answer.
• Distinguishes 'the control is not designed to do that' from 'the control failed'.
• Writes findings the owner can act on without a follow-up meeting.
• Re-tests remediation instead of closing on a plan.
• Says what was out of scope, in writing, before anyone asks.

• Lead assessor — owns the assessment plan and the client relationship.
• GRC analyst or risk manager — owns the register rather than the test.
• Security architect — designs the controls instead of testing them.
• Audit manager — owns the program, the schedule and the sign-off.