Security assessment and testing answers a simple question: do our controls actually work as intended? Domain 6 is about designing a program that answers it reliably and repeatedly, rather than running an occasional scan and hoping for the best. A good strategy starts from the organization's objectives, risks, regulatory obligations and most important systems, and then chooses the right mix of activities, frequencies and assessors. It is a management activity as much as a technical one, and its output is evidence that decision makers can rely on.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.