To assess security control effectiveness, state the result it must achieve, choose a safe way to check that result and compare what happens with the agreed requirement. A policy, a purchase order or a photograph can show that something exists. Each leaves further questions about how it operates.
This method is for a security manager assessing an ordinary control, such as visitor authorisation, access removal or incident notification. It is not permission to conduct covert entry tests, interfere with safety systems or examine personal information beyond your authority.
Start with a claim you can check
“Our visitor management is effective” is too broad for one test. It contains several claims: visits are authorised, hosts take responsibility, movement is controlled and records can be reconciled.
Choose one claim. For example: “Before a visitor enters the staff-only work area, an authorised host confirms responsibility and is identified in the visitor record.” That describes a result without assuming a particular technology.
Write the boundary beside it. Does it apply during reception hours only? What happens after hours? Are delivery personnel included? Does the control belong to your business or to a building manager? These distinctions determine what the evidence can establish.
Ask the control owner to agree the requirement before the test. Otherwise, a disappointing result can lead to an argument about what the control was supposed to do.
Examine the arrangement, then check its operation
Begin with the current procedure and any relevant records. Speak to the people who perform the task. Then use an authorised observation or exercise where that is needed to check operation.
NIST SP 800-53A Revision 5, section 2.4.2 distinguishes examination, interview and testing as assessment methods. It describes testing in terms of comparing behaviour under specified conditions with the expected result. That is a useful assessment principle here; this article does not claim to perform a NIST compliance assessment.
Each kind of evidence answers a different question. A procedure describes intended work. An interview can explain how staff handle exceptions. An observed exercise can show what happened under the conditions tested. Use the combination needed for your decision rather than collecting documents merely to fill a folder.
Prepare a small, controlled test
The example below is fictional. It concerns an announced reception exercise using staff acting as a visitor and host. No real visitor data, covert entry or confrontation is involved.
| Test element | Completed example |
|---|---|
| Claim | A visitor enters the staff-only area only after an authorised host confirms responsibility and is identified in the visitor record. |
| Conditions | Normal reception hours; one usual host and one authorised backup host are available. |
| Method | Observe an agreed exercise in which the usual host is unavailable and reception must use the backup process. |
| Expected result | Reception confirms an authorised backup before the visitor proceeds; the record shows who accepted responsibility. |
| Evidence | Observer's record, time of confirmation and a fictional visitor entry retained in the approved test file. |
| Stop condition | Stop if a real emergency, queue or service disruption requires staff attention. |
| Observed result | The backup confirms responsibility, but the entry still names the unavailable original host. |
The result supports a specific finding: the exercise demonstrated an authorisation step, but the record did not accurately identify the responsible host. It does not support “visitor management is fully effective” or “all visitor controls have failed”.
The correction is also specific. Amend the handover step, have staff demonstrate the revised process and check that the record reflects the person who actually accepted responsibility.
Choose coverage that matches the decision
A single convenient observation is rarely enough to justify a broad statement about every site, shift and exception. Decide which operating conditions could change the result. These might include reception closure, a different operator, a temporary worker or a dependency on an external service.
You do not need to test every possible combination for a small initial assessment. You do need to state which conditions you covered and which remain untested. If the decision concerns after-hours access, a daytime reception exercise leaves the main question unanswered.
There is no universal sample size for every security control. Choose coverage based on the consequence of failure, variation in operation and the confidence the decision requires. Where formal audit requirements prescribe sampling or testing, use those requirements and appropriately competent assessors.
Keep the selection method in your notes. “Three records supplied by the owner” carries a different limitation from “records selected by the assessor from the agreed population”. Neither phrase, alone, establishes representativeness.
Separate missing evidence from demonstrated failure
If the required result fails during a valid test, record the failure. If you cannot obtain evidence, record that the claim remains unverified. Those findings can both require action, but they have different meanings.
An unavailable record does not prove the underlying task never occurred. It may still reveal a recordkeeping weakness where a reliable record is part of the requirement. State both points instead of forcing an unsupported conclusion.
Also distinguish a design problem from an execution problem. If the procedure provides no route when the host is absent, retraining staff in that procedure will not resolve the gap. If a sound route exists but staff cannot access the contact details, the correction concerns capability and availability.
Report the finding so someone can act
Use a short structure: requirement, evidence, significance and action. For the fictional example:
“The visitor procedure requires the receiving host to be identifiable. In the announced backup-host exercise, authorisation occurred but the record retained the original host's name. This could leave staff unable to identify the current responsible host. Reception's manager will revise the handover step and demonstrate an accurate record in a repeat exercise.”
Add the evidence reference, owner and agreed completion date to the assessment record. Keep personal or security-sensitive details in the appropriate controlled location, rather than reproducing them in every report.
Retest the changed step
A corrected procedure is evidence of a changed design. It is not yet evidence that the new step works. Repeat the relevant exercise after staff have the instruction and resources needed to perform it. Record whether the original failure has been resolved and whether the change created another difficulty.
Start today with one important control and one explicit performance claim. Agree the boundary, evidence, safe method and acceptance criterion before conducting the check.
Place the control check within the wider assessment process, then distinguish the risk before and after treatment.
The SRMBOK Risk Control Effectiveness Criteria Template provides an editable starting point for describing and assessing control effectiveness. It is a paid resource. Adapt its criteria to the control and operating context, and attach evidence to the judgement rather than treating a selected rating as proof.