Security Assessment and Testing · Topic 3 of 3
Process Data, Analysis and Reporting
Collecting security process data such as account reviews, KPIs, KRIs and backup tests, then analyzing results, exceptions and ethical disclosure.
- 3 min
- Process data covers accounts, approvals, KPIs and KRIs, backups, training and DR or BC.
- Test the full population when you can; system evidence beats interviews.
- KPIs measure performance; KRIs warn of risk.
What it is
Security is not only technical controls; it is also processes such as account management, backups and training. Collecting process data shows whether those processes work. Analysis and reporting turn test and process data into decisions: what to fix, what to accept and how to tell people.
How it works
Security process data to collect
| Process | Evidence |
|---|---|
| Account management | Joiner, mover and leaver records; disabled accounts versus HR terminations |
| Management review and approval | Sign-offs on access, risk acceptance and policy |
| Key performance and risk indicators | Metrics on control performance and rising risk |
| Backup verification | Successful restore tests, not only backup job logs |
| Training and awareness | Completion and, more usefully, behaviour such as phishing report rates |
| Disaster recovery and business continuity | Exercise results and corrective actions |
Collecting good evidence
When the full population is available, test all of it rather than a sample. Comparing every HR termination with directory account status gives complete, objective evidence and exposes every exception. Interviews and procedure documents show intent, not whether controls worked.
Evidence from systems (logs, reports, configurations) is stronger than statements. Direct observation and full-population testing beat interviews.
KPIs and KRIs
| Type | Measures | Example |
|---|---|---|
| Key performance indicator (KPI) | How well a process performs | Percentage of critical patches applied within 30 days |
| Key risk indicator (KRI) | Early warning of rising risk | Number of systems past end of support |
Good metrics are specific, measurable, tied to objectives and reported consistently over time.
Analyzing test output
- Validate findings: remove false positives, confirm true positives.
- Rate severity by technical score and business context.
- Find root causes and patterns rather than fixing items one by one.
- Compare with earlier results to show trends.
Reporting
| Audience | Content |
|---|---|
| Executives and board | Risk in business terms, trends, decisions needed |
| Technical teams | Detailed findings, evidence and remediation steps |
| Auditors and regulators | Evidence of compliance and corrective actions |
Remediation and exception handling
Each finding gets an owner and a due date. When a finding cannot be fixed in time, an exception is documented: the risk, compensating controls, the approving risk owner and an expiry date for review. Exceptions without expiry become permanent hidden risk.
Ethical disclosure
When testing reveals a vulnerability in someone else's product, follow responsible (coordinated) disclosure: notify the vendor privately, give reasonable time to fix, then publish. For your own organization, report findings honestly even when they are uncomfortable.
How the exam asks about this
- "Confirm leavers' accounts were disabled; full HR and directory exports exist." Compare the full lists and follow up on mismatches.
- "Which metric warns of rising risk?" A key risk indicator.
- "A finding cannot be fixed before release." Document an exception with compensating controls, owner approval and expiry.
What to remember for the exam
- Process data covers accounts, approvals, KPIs and KRIs, backups, training and DR or BC.
- Test the full population when you can; system evidence beats interviews.
- KPIs measure performance; KRIs warn of risk.
- Report in business terms to executives, detail to technical teams.
- Exceptions need owners, compensating controls and expiry dates.
Backup job success logs do not prove recovery. Only restore tests do.
Common mistakes
Sampling when the whole population is available.
Counting training completions as proof of awareness.
Open-ended exceptions that are never reviewed.
Check yourself
What is the difference between a KPI and a KRI?
A KPI measures process performance; a KRI gives early warning of increasing risk.
What evidence best proves backups work?
Successful restore tests.
What should a documented risk exception include?
The risk, compensating controls, the approving owner and an expiry date.
Topic 3 of 3 in Security Assessment and Testing
Test yourself on Security Assessment and Testing
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.