Lion Cipher Lab
Conduct a security control assessment and build a POA&M (NIST RMF capstone)
- GRC / Compliance
- Advanced
- ~120 min
- Free · no account required
Why it matters
Writing that a control is implemented and proving it are two different jobs, and the gap between them is where breaches live. A System Security Plan is a set of CLAIMS; a security control assessment is the independent test of whether those claims are true, and it is the step that decides whether a system gets authorized to operate. This is RMF Step 5 (Assess), and NIST SP 800-53A is the government's rulebook for doing it — the same discipline behind every FedRAMP authorization, every SOC 2 audit, and every internal control review. The two artifacts you produce here, a Security Assessment…
What you'll learn
- Security control assessment (NIST RMF Step 5)
- Writing assessment procedures with NIST SP 800-53A
- Applying the examine / interview / test assessment methods
- Recording findings as Satisfied vs. Other Than Satisfied
- Building a Plan of Action & Milestones (POA&M)
- Producing a Security Assessment Report (SAR) section
Steps in this lab
- Where this sits: RMF Step 5, and why claims are not proof
- The tool for the job: NIST SP 800-53A
- The three assessment methods — examine, interview, test
- Independence and the assessor's mindset (the honesty step)
- Select the controls to assess and pull their SSP claims
- Write an assessment procedure for one control (the core skill)
- Gather the evidence — actually go and look
- Render each finding: Satisfied or Other Than Satisfied
- Turn every Other-Than-Satisfied finding into a POA&M entry
- Assemble the SAR + POA&M using the reusable templates
- Close the loop — what you assessed, and where it leads