Security Control Assessor: From Evidence to Findings

Lifetime course access

About Course

Assess security controls the way working assessors do: plan the assessment, test controls, gather evidence and write findings that stand up.

What you’ll do

Build a security assessment plan
Examine, interview and test to assess controls
Collect and judge evidence
Write findings and a security assessment report

Part of the GRC & Compliance track, aligned with DoD 8140 work role 612 Security Control Assessor.

Taught by practitioners who do this work every day. Finish the course to earn a certificate with CPE hours.

What you earn

Pass the graded HERON capstone (80%, with no rubric row at the lowest score) and the final knowledge check (70%) to earn Cover6 GRC & Compliance III. Your certificate shows 25 CPE hours, and anyone can check it at cover6solutions.com/verify.

Included: ISACA CISA® exam prep. CISA® is a registered trademark of ISACA. Cover6 Solutions is not affiliated with or endorsed by ISACA.

Before you start: RMF & ATO (GRC II) is the recommended first step. Next step: Security Manager Prep, the first course on the vCISO path.

Course Content

Welcome & Orientation

Lesson 0.1 — What this course is
Lesson 0.2 — Odapeeka, Year Three: your new seat
Lab 0 — Read the tasking memo

The Assessor Role, Independence and Ethics
Maps to: CISA Domain 1 Information System Auditing Process (audit standards, independence, ethics, risk-based planning) · Domain 2 Governance and Management of IT (roles and accountability)

NIST SP 800-53A Rev. 5: How Assessment Procedures Work
Maps to: CISA Domain 1 Information System Auditing Process (audit methodology, testing techniques) · Domain 5 Protection of Information Assets (control objectives for identity, logging and configuration)

Planning the Assessment: the SAP and Sampling
Maps to: CISA Domain 1 Information System Auditing Process (audit planning, risk-based audit, sampling methodology, audit project management)

Evidence: Quality, Sufficiency and Chain of Custody
Maps to: CISA Domain 1 Information System Auditing Process (audit evidence collection techniques, evidence reliability, documentation of audit work)

Assessing Management and Operational Controls
Maps to: CISA Domain 2 Governance and Management of IT (policies, risk management, personnel) · Domain 4 Information Systems Operations and Business Resilience (change and configuration management, backup, business continuity and incident management)

Testing Technical Controls I: Configuration and Vulnerability Review
Maps to: CISA Domain 5 Protection of Information Assets (security testing, hardening, vulnerability management) · Domain 4 Information Systems Operations and Business Resilience (configuration and patch management)

Testing Technical Controls II: Access, Identity and Logs
Maps to: CISA Domain 5 Protection of Information Assets (identity and access management, logging and monitoring) · Domain 4 Information Systems Operations and Business Resilience (log management)

Writing Findings
Maps to: CISA Domain 1 Information System Auditing Process (reporting and communication techniques, audit findings and recommendations, follow-up)

Risk Ratings and Residual Risk Statements
Maps to: CISA Domain 1 Information System Auditing Process (risk-based audit, audit reporting) · Domain 2 Governance and Management of IT (enterprise risk management, risk treatment)

The Security Assessment Report and POA&M Validation
Maps to: CISA Domain 1 Information System Auditing Process (audit reporting, communicating results, follow-up activities) · Domain 2 Governance and Management of IT (monitoring and assurance practices)

Continuous Monitoring Assessments and Other Assessor Programs
Maps to: CISA Domain 1 Information System Auditing Process (continuous auditing, quality assurance) · Domain 2 Governance and Management of IT (monitoring, third-party and vendor assurance)

Capstone: The HERON Assessment (graded)
Maps to: CISA Domain 1 Information System Auditing Process (planning, evidence, reporting, follow-up) · Domain 5 Protection of Information Assets (identity, logging, configuration, vulnerability management) · Domain 4 Information Systems Operations and Business Resilience (change management, backup)

Final Check & Your Next Step

Student Ratings & Reviews

No Review Yet

About Course

What you’ll do

What you earn

Course Content

Welcome & Orientation

Lesson 0.1 — What this course is

Lesson 0.2 — Odapeeka, Year Three: your new seat

Lab 0 — Read the tasking memo

The Assessor Role, Independence and Ethics <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit standards, independence, ethics, risk-based planning) · Domain 2 Governance and Management of IT (roles and accountability)</p>

Lesson 1.1 — What a Security Control Assessor does

Lesson 1.2 — Independence: in fact and in appearance

Lesson 1.3 — Professional skepticism and ethics

Lesson 1.4 — Audit risk and a risk-based assessment

Lesson 1.5 — Assessor and CISA terms to know

Lab 1 — Independence check

NIST SP 800-53A Rev. 5: How Assessment Procedures Work <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit methodology, testing techniques) · Domain 5 Protection of Information Assets (control objectives for identity, logging and configuration)</p>

Lesson 2.1 — Anatomy of an assessment procedure

Lesson 2.2 — Examine, interview, test

Lesson 2.3 — Depth, coverage and assurance

Lab 2 — Decompose AC-2 for OSPREY

Planning the Assessment: the SAP and Sampling <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit planning, risk-based audit, sampling methodology, audit project management)</p>

Lesson 3.1 — What goes in a Security Assessment Plan

Lesson 3.2 — Scoping: boundary, inheritance and reuse

Lesson 3.3 — Sampling for control testing

Lab 3A — Draft the OSPREY SAP summary

Lab 3B — Build and defend a sample

Evidence: Quality, Sufficiency and Chain of Custody <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit evidence collection techniques, evidence reliability, documentation of audit work)</p>

Lesson 4.1 — What makes evidence good enough

Lesson 4.2 — Chain of custody and the evidence register

Lesson 4.3 — Interviews that produce evidence

Lab 4 — Evidence triage

Lesson 5.1 — Policies, plans and risk assessments

Lesson 5.2 — People controls: training and personnel security

Lesson 5.3 — Configuration and change management

Lesson 5.4 — Contingency, backup and incident response

Lab 5A — Management and people controls

Lab 5B — Change, backup, contingency and termination

Lesson 6.1 — Configuration review against a baseline

Lesson 6.2 — Reviewing vulnerability scanning and flaw remediation

Lab 6A — Configuration review: the OSPREY web tier

Lab 6B — Vulnerability scan review

Testing Technical Controls II: Access, Identity and Logs <p><strong>Maps to:</strong> CISA Domain 5 Protection of Information Assets (identity and access management, logging and monitoring) · Domain 4 Information Systems Operations and Business Resilience (log management)</p>

Lesson 7.1 — Access reviews and authentication testing

Lesson 7.2 — Log review: event logging, review and retention

Lab 7A — Account reconciliation

Lab 7B — Log review evidence

Writing Findings <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (reporting and communication techniques, audit findings and recommendations, follow-up)</p>

Lesson 8.1 — The five parts of a finding

Lesson 8.2 — Writing conditions that survive challenge

Lesson 8.3 — Cause, recommendation and the management response

Lab 8 — Rewrite three weak findings

Risk Ratings and Residual Risk Statements <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (risk-based audit, audit reporting) · Domain 2 Governance and Management of IT (enterprise risk management, risk treatment)</p>

Lesson 9.1 — Rating a finding

Lesson 9.2 — Compensating and mitigating controls

Lesson 9.3 — Writing residual risk statements

Lab 9 — Rate four findings and write residual risk statements

The Security Assessment Report and POA&M Validation <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit reporting, communicating results, follow-up activities) · Domain 2 Governance and Management of IT (monitoring and assurance practices)</p>

Lesson 10.1 — The SAR and the conversation around it

Lesson 10.2 — Validating the POA&M and closing findings

Lab 10 — POA&M review

Continuous Monitoring Assessments and Other Assessor Programs <p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (continuous auditing, quality assurance) · Domain 2 Governance and Management of IT (monitoring, third-party and vendor assurance)</p>

Lesson 11.1 — Continuous monitoring and ongoing assessment

Lesson 11.2 — FedRAMP and CMMC assessors: the same craft, different rules

Lab 11 — Plan the OSPREY continuous monitoring year

Lesson 12.1 — Your capstone brief and how it is graded

Lesson 12.2 — The HERON evidence packet

Lab 12 — Capstone submission: HERON SAR excerpt

Final Check & Your Next Step

Lesson 13.1 — Final knowledge check

Final Knowledge Check

Lesson 13.2 — Your next step: Security Manager Prep (vCISO path)

Student Ratings & Reviews

Academy

Services

Latest from the blog

Careers & Partners

Legal

The Assessor Role, Independence and Ethics
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit standards, independence, ethics, risk-based planning) · Domain 2 Governance and Management of IT (roles and accountability)</p>

NIST SP 800-53A Rev. 5: How Assessment Procedures Work
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit methodology, testing techniques) · Domain 5 Protection of Information Assets (control objectives for identity, logging and configuration)</p>

Planning the Assessment: the SAP and Sampling
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit planning, risk-based audit, sampling methodology, audit project management)</p>

Evidence: Quality, Sufficiency and Chain of Custody
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit evidence collection techniques, evidence reliability, documentation of audit work)</p>

Testing Technical Controls II: Access, Identity and Logs
<p><strong>Maps to:</strong> CISA Domain 5 Protection of Information Assets (identity and access management, logging and monitoring) · Domain 4 Information Systems Operations and Business Resilience (log management)</p>

Writing Findings
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (reporting and communication techniques, audit findings and recommendations, follow-up)</p>

Risk Ratings and Residual Risk Statements
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (risk-based audit, audit reporting) · Domain 2 Governance and Management of IT (enterprise risk management, risk treatment)</p>

The Security Assessment Report and POA&M Validation
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (audit reporting, communicating results, follow-up activities) · Domain 2 Governance and Management of IT (monitoring and assurance practices)</p>

Continuous Monitoring Assessments and Other Assessor Programs
<p><strong>Maps to:</strong> CISA Domain 1 Information System Auditing Process (continuous auditing, quality assurance) · Domain 2 Governance and Management of IT (monitoring, third-party and vendor assurance)</p>