What is a security control assessment and how is it different from a vulnerability assessment?

• A. Control assessment tests whether controls exist and operate as intended.
• B. Vulnerability assessment tests whether controls exist and operate as intended.
• C. Control assessment identifies weaknesses in systems that could be exploited.
• D. Vulnerability assessment only covers physical security.

Answer: (A)

Security control assessment focuses on the safeguards themselves: it verifies that controls exist, are properly implemented, and operate as intended to reduce risk. It examines both design and performance, gathering evidence that a control is in place, correctly configured, and functioning under normal and test conditions. This approach ensures the protective measures actually provide the intended protection, not just that something could be exploited.

Vulnerability assessment, on the other hand, looks for weaknesses in systems that could be exploited, such as missing patches, misconfigurations, or insecure settings. It doesn’t specifically verify whether a given control exists or works; it identifies flaws that an attacker might leverage.

The statement about testing whether controls exist and operate as intended best captures the purpose of a security control assessment, rather than focusing on finding exploitable weaknesses or on physical security alone.