Lion Cipher Lab
Write a control narrative and test design and operating effectiveness
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
Every security assurance report you will meet — a SOC 2 Type II, an ISO 27001 internal audit, a SOX IT general controls review, a NIST SP 800-53A assessment for a federal system — comes down to two questions about each control. Is it designed to address the risk? And did it actually operate, consistently, over the period? Those are different questions with different evidence, and mixing them up is the most common mistake new GRC analysts make. A beautifully written access-approval procedure is a design. It says nothing about whether last quarter's 400 access requests were approved before…
What you'll learn
- writing a control narrative: who, what, when, how, evidence
- performing a walkthrough of one control instance
- the difference between design effectiveness and operating effectiveness
- defining test attributes before looking at evidence
- performing an attribute test and recording deviations
- concluding on a control and writing it up
- the NIST SP 800-53A assessment methods: examine, interview, test
Steps in this lab
- Two questions, two kinds of evidence
- The control you will test
- Write the control narrative
- Walk one instance through, and conclude on design
- Define the attributes before you look
- Perform the test on the 12-ticket sample
- Conclude, and write it so someone can act