Chapter 6 of 8 · ISC2 CISSP
Security Assessment and Testing
Assessment, test and audit strategies, security control testing, process data collection, reporting and audit facilitation.
- 3topics
- 10 minfast track
- 12%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Assessment and Audit StrategiesDesigning assessment, test and audit strategies, internal, external and third-party audits, SOC reports, auditor independence and…4 min
- 2Security Control TestingVulnerability assessment and penetration testing, log reviews, synthetic transactions, code review, misuse cases, coverage…3 min
- 3Process Data, Analysis and ReportingCollecting security process data such as account reviews, KPIs, KRIs and backup tests, then analyzing results, exceptions and…3 min
About this chapter
What this chapter covers
Security Assessment and Testing is worth 12 percent of the CISSP exam. It asks how an organization gains justified confidence that its controls work: by designing assessments, running the right tests, collecting evidence, analyzing results and working with auditors.
It covers designing and validating assessment, test and audit strategies (internal, external and third-party, at locations including on premises, cloud and hybrid), conducting security control testing (vulnerability assessment, penetration testing, log reviews, synthetic transactions, code review, misuse cases, coverage analysis, interface testing, breach attack simulations, compliance checks), collecting security process data (account management, management review, KPIs and KRIs, backup verification, training, disaster recovery and business continuity), analyzing results and reporting (remediation, exception handling, ethical disclosure) and conducting or facilitating audits.
How the topics fit together
Expect questions on which test reveals what, which audit type fits, how independence is protected and how to respond to findings honestly.
Every method has a blind spot. Scans list weaknesses but do not prove exploitation; penetration tests prove exploitation but only sample; self-assessments lack independence.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.