Security Control Assurance Pack — Guide

Security Control Assurance

Most organisations find out whether their controls work once a year, when an auditor or a customer asks for evidence. The weeks before are spent finding records, explaining gaps and hoping the sample comes out clean. This pack moves that work into the year. Each control is written down, tested on a schedule set by its risk, on a sample the tester chooses, by someone who does not run it. A failure becomes a deficiency with an owner, a deadline and a retest. When the audit comes, the answers are already on file.

Is this for you?

This pack is for you if:

• an auditor, a supervisor or a customer will ask you to show that your controls work, and you would have to gather the evidence from scratch;
• your controls are tested by the people who run them, or not at all;
• NIS2 asks you to assess whether your security measures are effective, and you have no method for it;
• several frameworks apply to you and you test the same control once for each of them.

How it works

A control test asks two questions. Would the control, as written, keep its risk in check? That is the design test, a walk through one occurrence. Did it run that way throughout the period? That is the operating test, on a sample.

The tester takes every occurrence in the period from the system that records it, checks the list is complete, and chooses the sample. The sample size depends on how many times the control ran and how much rests on it: two for a control that ran a dozen times, five for one that ran fifty times, more for a control on which a serious risk rests. No exception means Effective. One exception in a manual control means testing the same number again: if nothing else fails, the control is Effective and the exception is recorded. Anything more is Not effective.

A failure is a deficiency, rated High, Medium or Low by whether the control is key and whether another control was tested and found to cover the risk. The owner agrees a plan within ten working days and fixes it within 90, 180 or 365 days. A deficiency closes only when a retest passes.

Thirty controls come with the pack, each taken from a rule a published CISO Times pack already sets: leavers’ access, urgent fixes, access reviews, supplier reassessment, incident reviews and more. Add your own in the same form.

Control testing is not an internal audit, a certification audit or a maturity assessment, and a test result is not a statement that you comply with anything. It feeds all of them.

How it runs in practice

Take a distributor with 900 staff, three warehouses and an online ordering service, an important entity under NIS2. In September 2026 its Quality and Compliance Manager, who runs none of the controls, took on control testing. The Internal Audit Manager reviews the lead’s workpapers.

The lead piloted seven tests over March to August 2026. Leavers’ access was Effective: one leaver’s ERP account stayed open for 19 days until the monthly reconciliation found it. The tester recorded that as an exception and tested five more leavers, all removed on time. Urgent fixes were Not effective: two of five findings missed their June deadlines with no deferral. The policy review control could not be tested, because no register says when a review falls due. Both failures became High deficiencies, linked to work the risk and NIS2 plans had already set.

The Chief Operating Officer approved the year’s plan on 30 September. Higher-risk controls are tested twice a year, Standard ones once, and Lower ones every two years, with every design checked each year. The five controls the largest customer’s review relies on are tested by the end of March, so every workpaper is signed more than six weeks before the review.

Start with these three

1. Control Testing Methodology: what a test is, sample sizes, what passes, severity and retest, and the rules behind each.
2. Control Inventory & Ownership Register: the thirty controls with owners, risk ratings and when each is next due.
3. Control Test Workpaper Template: one test from population to conclusion, with the sample size and conclusion worked out for you.

Your first round

What to report

Each quarter, to the executive committee or the board:

• controls tested within their cycle, out of the controls in the inventory;
• tested controls that were effective;
• key controls never tested, by name;
• open deficiencies by severity, and any past their due date.

Everything in the pack

Adapting it

• Which control serves which requirement: the mapping workbook lists each framework’s requirements in their own words and leaves that pairing to you. It is your judgement, and auditors will ask you to defend it.
• Certification: if you hold or seek ISO/IEC 27001, your internal audit programme remains the audit the standard asks for. Test results are evidence it can use.
• Maturity: a maturity assessment rates whole practices; this pack tests single controls. Run both, and let each feed the other.
• Backups: no control in the set tests restores yet. Add your own restore-test control in the same form.

Framework references

• ISO/IEC 27001:2022: Annex A 5.36.
• NIST CSF 2.0: ID.IM-01.
• NIS2: Article 21(2)(f).
• DORA: Article 6(6).