Security Controls Evaluation, Testing, and Assessment Handbook

Chapter 12

Evidence of Assessment

Abstract

The various types of assessment and audit evidence are discussed. These include artifacts, test reports automated tool outputs, and the techniques for sampling are reviewed as well.

Keywords

evidence

artifact

sampling

types of evidence

Evidence of the test, evaluation, and assessment activities is often critical to the authorizing official in making the risk-based decision concerning the operation of the system under review. As SP 800-53A states: “Building an effective assurance case for security and privacy control effectiveness is a process that involves:

(i) Compiling evidence from a variety of activities conducted during the system development life cycle that the controls employed in the information ...