Module 20: Information Security Control Testing and Evaluation

What the Exam Is Really Testing

Behind the scenarios in this area sits a clear principle:

Control effectiveness must be validated regularly to ensure residual risk remains within tolerance.

Testing provides:

• Assurance to leadership
• Evidence for audit
• Validation of control design
• Detection of control degradation
• Input into risk reassessment

Controls that are not tested are assumed — not proven.

The Executive Mindset Shift

What most people do:

If the control is implemented, it works.

What CISM expects:

Controls degrade, fail, or become misaligned over time — validation is required.

Security leaders must:

• Define testing frequency
• Align testing with risk level
• Document results
• Identify deficiencies
• Ensure remediation
• Report findings appropriately

Testing is a governance function — not just a technical one.

Types of Control Testing

1. Design Effectiveness Testing

Evaluates whether the control, as designed, addresses the intended risk.

Question:

Is this control logically capable of reducing the risk?

Occurs before or during implementation.

2. Operating Effectiveness Testing

Evaluates whether the control is functioning as intended.

Question:

Is the control consistently operating over time?

Includes:

• Access reviews
• Log verification
• Control walkthroughs
• Audit sampling

This is heavily tested in CISM.

3. Independent Validation

Testing may be performed by:

• Internal audit
• Compliance teams
• External assessors

Independence increases assurance credibility.

Frequency and Risk Alignment

Testing frequency should reflect:

• Asset criticality
• Regulatory exposure
• Threat landscape
• Prior control failures

High-risk controls require more frequent testing.

Governance Integration

Testing results must:

• Be documented
• Feed into risk register updates
• Trigger remediation tracking
• Inform executive reporting
• Influence resource allocation

Testing without remediation tracking is incomplete governance.

Pattern Recognition

When testing appears in a scenario, ask:

1. Is effectiveness validated regularly?
2. Is testing risk-based?
3. Are deficiencies documented?
4. Is remediation tracked?
5. Is escalation defined?

Correct answers often involve:

• Independent validation
• Risk-based testing frequency
• Documented findings
• Root cause analysis
• Formal remediation tracking

Not:

• Assuming controls work
• Testing only after incidents
• Ignoring repeated findings
• Performing testing without documentation

Trap Pattern

Common wrong instincts:

• “Control was implemented, so it’s effective.”
• “Audit will find issues later.”
• “Testing is optional for low-incident systems.”
• “One-time testing is sufficient.”

CISM emphasizes continuous validation.

Scenario Practice

Question 1

A high-risk access control was implemented last year but has not been reviewed since.

What is the PRIMARY concern?

1. Encryption weakness
2. Vendor inefficiency
3. Lack of operating effectiveness validation
4. Monitoring delay

Question 2

Internal audit identifies repeated control failures across departments.

What should occur FIRST?

1. Increase monitoring tools
2. Conduct root cause analysis and update remediation plan
3. Replace all controls
4. Ignore minor failures

Question 3

A preventive control exists but has never been evaluated for design adequacy.

What is the MOST appropriate action?

1. Conduct design effectiveness review
2. Increase enforcement
3. Remove the control
4. Replace with detective monitoring

Question 4

Control testing results are documented but not communicated to leadership.

What is the PRIMARY governance weakness?

1. Encryption gap
2. Monitoring deficiency
3. Vendor inefficiency
4. Lack of reporting integration

Question 5

A low-risk control is tested annually, while a high-risk control is tested once every three years.

What is the MOST significant issue?

1. Over-testing
2. Misalignment between testing frequency and risk level
3. Monitoring delay
4. Vendor inefficiency

Key Takeaway

In CISM:

Controls must be tested. Testing must be risk-based. Findings must drive remediation. Results must inform governance.

Before assuming effectiveness:

• Validate design.
• Test operation.
• Document results.
• Track remediation.
• Escalate when necessary.

The line between a good answer and a wrong one is whether effectiveness is validated or assumed.