Putting a control in place is only half the job. An SSCP must also document what the control is supposed to do and verify that it actually does it. Controls drift: someone adds a firewall exception, a service is reinstalled with default settings, a logging agent stops sending. Documentation and verification catch that drift before an attacker does.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 4 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.