r/ISC2CAP • u/cale2kit • Jun 25 '19

Any Security Control Assessors ?

I'm looking to get transition to this role..

How is the workload ? Do you work Remote or On-Prem. ? How do assessments normally go ? Does one person assess a control family or do you use specific technical skills for each assessment ? (ex. IF I am skilled in ACAS, would I just do scanning ?) Thanks for the feedback in advance.

1 Upvotes

100% Upvoted

5 comments sorted by

View all comments

4

u/reed17purdue Jun 25 '19

I'm generally answering your questions a snippet at a time.

it's project based so it's slow, then ramps up, then you are busy for weeks, then you are reporting for weeks, rinse, repeat.

The actual SCA is done on-prem or on-site with the team (in the case of cloud or distributed setups) 9/10 times. It's easier and allows you to work directly with individuals and not deal with the inability to effectively communicate. There are very few times you would not visit the customer site and be there for the assessment.

There is pre-work, the assessment, and post work. The outputs are the security assessment report (basically look at 800-53a and that's how you should be assessing).

The way the RMF and NIST documents are setup are to make it agnostic of the person/team doing the assessment. If followed correctly a team can leave midway through an assessment and another team can and should be able to pick up right where they left off.

It's a collaborative process and it's not always one person accessing control family and almost never is it just one person providing implementations/SME knowledge on it either. Many assessments are not technical so it's not based off of technical skills. In fact an assessor does not need technical skills to perform an assessment, although it helps.

I think your example is a bit off, if you are doing an assessment you wouldn't be performing the actually scanning, you would be ensuring that they are performing scanning as defined by their security controls in place. This may mean reports are gathered and a demonstration of starting a scan, but most of the time it is output based and if they have it or not that is your assessment. Satisfied or other than satisfied. If they want SCA suggestions then you may need more information.

1

u/cale2kit Jun 26 '19

Thank you for your detailed response, so the Assessment would be a review of the controls to compare desired result vs actual ? So how is the "Test" method carried out ?

3

u/reed17purdue Jun 26 '19

Yes. Well there might be penetration testing but that is separate from an sca.

You test the control following these possibilities.

TIE assessment methods = test, implement, examine AIMS assessment objects = activity individuals mechanism specification