The Security Risk Assessment Handbook, 2nd Edition

200  ◾  The Security Risk Assessment Handbook

© 2011 by Taylor & Francis Group, LLC

e security risk assessment team is encouraged to review Table6.21 and add or

modify table elements to suit its own needs and experiences.

6.2.5 Test Administrative Security Controls

e last phase of data gathering for administrative security controls in the RIIOT

method is testing. Testing of administrative controls is the process of invoking con-

ditions that should trigger the administrative controls and reviewing the response

against the policies, procedures, and good practice. is type of data gathering

provides excellent insight into the actual eectiveness of the controls, but it can

only be applied in a limited fashion.

e administrative controls that lend ...