Security Control Assurance Pack — Guide
- Version 1.1
- Updated
- 9 documents
- Word, Excel
Security Control Assurance
Most organisations find out whether their controls work once a year, when an auditor or a customer asks for evidence. The weeks before are spent finding records, explaining gaps and hoping the sample comes out clean. This pack moves that work into the year. Each control is written down, tested on a schedule set by its risk, on a sample the tester chooses, by someone who does not run it. A failure becomes a deficiency with an owner, a deadline and a retest. When the audit comes, the answers are already on file.
Is this for you?
This pack is for you if:
- an auditor, a supervisor or a customer will ask you to show that your controls work, and you would have to gather the evidence from scratch;
- your controls are tested by the people who run them, or not at all;
- NIS2 asks you to assess whether your security measures are effective, and you have no method for it;
- several frameworks apply to you and you test the same control once for each of them.
How it works
A control test asks two questions. Would the control, as written, keep its risk in check? That is the design test, a walk through one occurrence. Did it run that way throughout the period? That is the operating test, on a sample.
The tester takes every occurrence in the period from the system that records it, checks the list is complete, and chooses the sample. The sample size depends on how many times the control ran and how much rests on it: two for a control that ran a dozen times, five for one that ran fifty times, more for a control on which a serious risk rests. These sizes are a judgemental floor and give no assurance about any rate of failure: five items with no exception are consistent with a control that fails in about 45% of occurrences. No exception means Effective. One exception in a manual control means testing the same number again: if nothing else fails, the control is Effective with exception, the owner gives the root cause, and the result is relied on only with both stated. Anything more is Not effective.
A failure is a deficiency, rated High, Medium or Low by whether the control is key and whether another control was tested and found to cover the risk. The owner agrees a plan within ten working days and fixes it within 90, 180 or 365 days. A deficiency closes only when a retest passes.
Thirty controls come with the pack, each taken from a rule a published CISO Times pack already sets: leavers’ access, urgent fixes, access reviews, supplier reassessment, incident reviews and more. They are manual rules, tested by inspecting the records they leave. None tests an automated or technical control such as multi-factor authentication enforcement, logging, encryption or a backup restore; add your own for those, with their own evidence. The control and requirement workbook lists controls and requirements side by side and leaves every pairing blank, so it is a list to fill in and not a crosswalk. The assurance lead sits in the second line, and internal audit, the third line, signs no workpaper: it re-performs a sample before it relies on one (IIA, The IIA’s Three Lines Model: An update of the Three Lines of Defense, 2020).
Control testing is not an internal audit, a certification audit or a maturity assessment, and a test result is not a statement that you comply with anything. It feeds all of them.
How it runs in practice
Take a distributor with 900 staff, three warehouses and an online ordering service, an important entity under NIS2. In September 2026 its Quality and Compliance Manager, who runs none of the controls, took on control testing. The Risk Manager, also second line, reviews the lead’s workpapers. The Internal Audit Manager signs none and re-performs a sample before relying on any.
The lead piloted seven tests over March to August 2026. Leavers’ access was Effective with exception: one leaver’s ERP account stayed open for 19 days until the monthly reconciliation found it. The tester recorded that as an exception and tested five more leavers, all removed on time. The owner found the root cause, a missing line on HR’s leaver checklist, and fixed it. Urgent fixes were Not effective: two of five findings missed their June deadlines with no deferral. The policy review control could not be tested, because no register says when a review falls due. Both failures became High deficiencies, linked to work the risk and NIS2 plans had already set.
The Chief Operating Officer approved the year’s plan on 30 September. Higher-risk controls are tested twice a year, Standard ones once, and Lower ones every two years, with every design checked each year. The five controls the largest customer’s review relies on are tested by the end of March, so every workpaper is signed more than six weeks before the review.
Start with these three
- Control Testing Methodology: what a test is, sample sizes, what passes, severity and retest, and the rules behind each.
- Control Inventory & Ownership Register: the thirty controls with owners, risk ratings and when each is next due.
- Control Test Workpaper Template: one test from population to conclusion, with the sample size and conclusion worked out for you.
Your first round
| When | What to do | You’re done when |
|---|---|---|
| Week 1 | Choose a lead who runs none of the controls, and a sponsor from management. List your controls in the inventory, mark the key ones and rate each one’s risk. | Every control has an owner, a risk rating and a written statement. |
| Week 2 | Pick five or six key controls for a pilot. Walk each design through one occurrence. | Each pilot control’s design is Adequate or a recorded deficiency. |
| Weeks 3 and 4 | Take each population, choose the samples and test them. Have someone other than the tester review each workpaper. | Every pilot test has a signed conclusion, and every failure is a rated deficiency with an owner. |
| Week 5 | Draft the year’s plan around your audits and reviews, and have the sponsor approve it. | The plan is approved before its year starts. |
What to report
Each quarter, to the executive committee or the board:
- controls tested within their cycle, out of the controls in the inventory;
- tested controls that were effective;
- key controls never tested, by name;
- open deficiencies by severity, and any past their due date.
Everything in the pack
- Word
Control Testing Methodology
Design and operating tests, samples, conclusions, severity and frequency
- Excel
Control Inventory & Ownership Register
Controls with owners, frequency, evidence, risk rating and next test
- Excel
Unified Control Framework Mapping Workbook
Your controls beside the ISO 27001, NIST CSF, NIS2 and DORA requirements, for you to record which you rely on for what
- Word
Control Test Execution Procedure
One test, step by step, through to deficiency and retest
- Excel
Control Test Workpaper Template
The workpaper, with two worked examples
- Excel
Control Evidence Standards Checklist
What acceptable evidence looks like, by kind of control
- Excel
Control Deficiency & Remediation Tracker
Deficiencies by severity through to retest
- Excel
Annual Control Testing Plan
The year’s tests by month, around audits and capacity
- Excel
Control Assurance Dashboard
The quarter’s results as counts, with deficiencies by name
No document matches those words.
Adapting it
- Which control serves which requirement: the mapping workbook lists each framework’s requirements in their own words and leaves that pairing to you. It is your judgement, and auditors will ask you to defend it.
- Certification: if you hold or seek ISO/IEC 27001, your internal audit programme remains the audit the standard asks for. Test results are evidence it can use.
- Maturity: a maturity assessment rates whole practices; this pack tests single controls. Run both, and let each feed the other.
- Backups: no control in the set tests restores yet. Add your own restore-test control in the same form.
Framework references
- ISO/IEC 27001:2022: Annex A 5.36.
- NIST CSF 2.0: ID.IM-01.
- NIS2: Article 21(2)(f).
- DORA: Article 6(6).