<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-control-testing
description: >-
  Plan and execute security control testing to validate effectiveness of implemented safeguards.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - control-testing
  - audit
  - validation
  - compliance
  - control-effectiveness
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Control Testing

## Overview

Security control testing validates that implemented controls operate as
intended and effectively reduce risk. Testing verifies the control is properly
configured, consistently enforced, and producing the expected security outcome.

## Prerequisites

| Requirement | Install |
|---|---|
| Control catalog | List of implemented controls |
| Test plan | Scope and methodology approved |
| Evidence repository | Secure storage for test artifacts |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Testing Methods

| Method | Description | Best For |
|---|---|---|
| Inquiry | Interview control owners | Process controls |
| Observation | Watch control operation | Operational controls |
| Inspection | Review documentation/configs | Technical controls |
| Re-performance | Execute control independently | Automated controls |
| Simulation | Test with synthetic scenarios | Detective controls |

### Test Design

Each test includes:
- **Control ID** — Reference to control catalog
- **Test objective** — What is being validated
- **Test procedure** — Step-by-step instructions
- **Expected result** — What passing looks like
- **Evidence requirements** — Artifacts to collect
- **Pass/fail criteria** — Objective determination

### Finding Severity

| Severity | Definition |
|---|---|
| Critical | Control absent or completely ineffective |
| High | Significant gaps in effectiveness |
| Medium | Effective but inconsistently applied |
| Low | Minor deviation from expected config |
| Informational | Observation, no risk impact |

## Workflow

1. **Define test scope** — select controls based on risk priority
2. **Develop test procedures** — create step-by-step test scripts
3. **Schedule testing** — coordinate with control owners
4. **Execute tests** — perform using appropriate methodology
5. **Collect evidence** — capture screenshots, logs, configuration exports
6. **Document findings** — report results with severity and remediation
7. **Track remediation** — monitor finding closure and retest

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Verification

| Check | Method |
|---|---|
| Scope defined | Control test inventory approved |
| Tests documented | Procedures written for all in-scope controls |
| Evidence collected | Artifacts stored securely for each test |
| Findings reported | Results documented with severity ratings |
| Remediation tracked | Open findings tracked to closure |

## References

- [NIST SP 800-53A](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final)
- [ISACA — IT Audit Framework](https://www.isaca.org/resources/it-audit)
- [SOC 2 — Trust Services Criteria](https://www.aicpa-cima.com/)
- [ISO 27001 Clause 9](https://www.iso.org/standard/27001)
