<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-control-effectiveness-review
description: >-
  Evaluate the effectiveness of implemented security controls through testing,
  metrics collection, coverage analysis, and gap identification to ensure controls
  deliver their intended risk reduction.
domain: cybersecurity
subdomain: security-architecture
tags:
  - control-effectiveness
  - security-metrics
  - control-testing
  - gap-analysis
  - kpi
  - risk-reduction
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Control Effectiveness Review

## Overview

Security control effectiveness reviews verify that implemented controls function as
designed and deliver measurable risk reduction. This skill covers control testing
methodologies, effectiveness metrics, coverage analysis, and evidence-based gap
identification.

Mode: `[MODE: ARCHITECT]` — Control validation and effectiveness measurement.

## Prerequisites

- Control inventory with implementation status
- Security monitoring data (SIEM, EDR, vulnerability scans)
- Compliance framework mappings
- Python 3.10+

## Key Concepts

### Control Effectiveness Maturity Levels

| Level | Label | Description | Score Range |
|-------|-------|-------------|-------------|
| 0 | **Non-existent** | Control not implemented | 0 |
| 1 | **Ad-hoc** | Implemented inconsistently | 1-20 |
| 2 | **Defined** | Documented and repeatable | 21-40 |
| 3 | **Managed** | Measured and monitored | 41-60 |
| 4 | **Optimized** | Continuously improved | 61-80 |
| 5 | **Adaptive** | Automated and self-adjusting | 81-100 |

### Effectiveness Metrics

```json
{
  "control": "endpoint-detection",
  "metrics": {
    "coverage_pct": 94.5,
    "detection_rate": 87.3,
    "mean_time_to_detect_hours": 0.5,
    "false_positive_rate": 12.1,
    "mean_time_to_respond_hours": 2.3,
    "last_tested": "2026-01-15",
    "test_method": "purple-team-exercise"
  },
  "effectiveness_score": 72,
  "maturity_level": 4,
  "gaps": [
    "5.5% endpoints without agent",
    "No coverage for containerized workloads"
  ]
}
```

### Control Testing Methods

| Method | Description | Frequency |
|--------|-------------|-----------|
| **Automated scan** | Vulnerability and config scanning | Continuous |
| **Tabletop exercise** | Scenario-based walkthrough | Quarterly |
| **Purple team** | Controlled attack simulation | Semi-annual |
| **Penetration test** | External adversary simulation | Annual |
| **Red team** | Full-scope adversary emulation | Annual |
| **Audit evidence** | Document and log review | Continuous |

### Control Effectiveness Dashboard Schema

```yaml
dashboard:
  sections:
    - name: Detection Controls
      controls:
        - name: EDR
          coverage: 94.5%
          detection_rate: 87.3%
          status: effective
        - name: SIEM Correlation
          coverage: 78.0%
          detection_rate: 62.1%
          status: partially-effective
    - name: Preventive Controls
      controls:
        - name: WAF
          coverage: 100%
          block_rate: 95.2%
          status: effective
        - name: MFA
          coverage: 89.0%
          bypass_attempts: 0
          status: partially-effective
```

## Workflow

### Step 1: Inventory Controls

```bash
node scripts/agent.js --action inventory --controls controls.json
```

### Step 2: Assess Effectiveness

```bash
node scripts/agent.js --action assess --controls controls.json --metrics metrics.json
```

### Step 3: Identify Gaps

```bash
node scripts/agent.js --action gaps --assessment assessment.json --output gaps.json
```

### Step 4: Generate Report

```bash
node scripts/agent.js --action report --assessment assessment.json --output report.json
```

## Verification

- [ ] All critical controls have effectiveness scores
- [ ] Coverage metrics calculated for each control
- [ ] Detection rates measured through testing exercises
- [ ] False positive rates tracked and trended
- [ ] Gaps documented with remediation recommendations
- [ ] Maturity levels assigned based on evidence
- [ ] Review cadence established (quarterly minimum)

## References

- [NIST SP 800-53A Assessing Security Controls](https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final)
- [CIS Controls v8 Measures and Metrics](https://www.cisecurity.org/controls/v8)
- [MITRE ATT&CK Evaluations](https://attackevals.mitre-engenuity.org/)
