Assessment and Audit Plan Development: A Comprehensive Guide for CGRC Exam Preparation
Assessment and Audit Plan Development
Why Is Assessment and Audit Plan Development Important?
Assessment and audit plan development is a cornerstone of effective information security governance. Without a well-structured plan, organizations risk conducting incomplete, inconsistent, or inefficient evaluations of their security and privacy controls. Here is why it matters:
• Ensures Comprehensive Coverage: A well-developed plan ensures that all relevant security and privacy controls are evaluated systematically, leaving no critical gaps in the assessment process.
• Supports Compliance: Many regulatory frameworks, including FISMA, HIPAA, FedRAMP, and others, require documented assessment and audit plans. Having a formal plan demonstrates due diligence and helps organizations maintain compliance.
• Optimizes Resources: Planning helps allocate personnel, time, budget, and tools effectively, ensuring that the most critical systems and controls receive appropriate attention.
• Establishes Accountability: A documented plan clearly defines roles, responsibilities, timelines, and expectations, holding all stakeholders accountable for their contributions to the assessment process.
• Facilitates Risk-Based Decision Making: The plan enables prioritization of assessment activities based on risk, ensuring that high-impact and high-risk systems and controls are evaluated first.
• Provides Repeatability and Consistency: A standardized plan ensures that assessments are conducted consistently across different systems, time periods, and assessors.
What Is Assessment and Audit Plan Development?
Assessment and audit plan development is the structured process of creating a documented strategy that defines what will be assessed, how it will be assessed, when it will be assessed, and by whom. It serves as the blueprint for conducting security and privacy control assessments and audits.
According to NIST SP 800-53A (Assessing Security and Privacy Controls in Information Systems and Organizations), the security assessment plan outlines the assessment procedures, scope, methodology, and logistics for evaluating the implementation and effectiveness of controls.
Key Components of an Assessment and Audit Plan:
1. Scope and Objectives: Clearly defines the boundaries of the assessment, including which systems, controls, and organizational units are included. The objectives state what the assessment aims to achieve — typically to determine whether controls are implemented correctly, operating as intended, and producing the desired outcome.
2. Assessment Methodology: Describes the approach and techniques that will be used. NIST SP 800-53A defines three primary assessment methods:
- Examine: Reviewing, inspecting, and analyzing assessment objects such as specifications, mechanisms, policies, procedures, plans, and activities.
- Interview: Conducting discussions with individuals or groups to facilitate understanding, clarification, and identification of evidence.
- Test: Exercising assessment objects (mechanisms, activities) under specified conditions to compare actual behavior with expected behavior.
3. Assessment Objects: These are the items being assessed and fall into four categories:
- Specifications (e.g., policies, procedures, plans, system designs)
- Mechanisms (e.g., hardware, software, firmware implementing controls)
- Activities (e.g., system operations, administration, management)
- Individuals (e.g., personnel performing activities or exercising responsibilities)
4. Assessment Procedures: Detailed step-by-step procedures for each control being assessed. Each procedure typically includes a determination statement that the assessor must evaluate as satisfied or other than satisfied.
5. Roles and Responsibilities: Identifies key personnel involved, including:
- The Authorizing Official (AO) who approves the plan
- The Security Control Assessor (SCA) who leads the assessment
- The System Owner who provides access and information
- The Information System Security Officer (ISSO) who coordinates activities
- Any additional team members or independent assessors
6. Schedule and Milestones: A timeline that outlines when different phases of the assessment will occur, including preparation, execution, analysis, reporting, and remediation verification.
7. Rules of Engagement: Specifies constraints, limitations, and ground rules for the assessment, including any restrictions on testing (e.g., no penetration testing during peak business hours, restrictions on production system testing).
8. Resource Requirements: Identifies tools, access requirements, facilities, and any other resources needed to conduct the assessment.
9. Reporting Requirements: Defines the format, content, and distribution of assessment reports, including interim findings and the final Security Assessment Report (SAR).
10. Risk Assessment Integration: Describes how the assessment plan aligns with the organization's risk management strategy and how findings will feed into risk-based decisions.
How Does Assessment and Audit Plan Development Work?
The development of an assessment and audit plan follows a structured lifecycle that aligns with the NIST Risk Management Framework (RMF), specifically Step 4 — Assess. Here is the typical process:
Phase 1: Preparation and Planning
• Review the system's authorization boundary and system categorization (FIPS 199/FIPS 200)
• Review the System Security Plan (SSP) and Privacy Plan to understand implemented controls
• Identify applicable control baselines (NIST SP 800-53) and any tailored or supplemental controls
• Determine the depth and coverage of the assessment based on risk and assurance requirements
• Select assessment procedures from NIST SP 800-53A or develop customized procedures
• Identify assessment team members and verify their independence requirements
• Coordinate with the system owner, ISSO, and other stakeholders
Phase 2: Plan Documentation
• Document the scope, objectives, methodology, and logistics
• Define specific assessment procedures for each control
• Establish the schedule, milestones, and deliverables
• Document rules of engagement and any constraints
• Include contingency plans for assessment disruptions
Phase 3: Plan Review and Approval
• Submit the plan to the Authorizing Official (AO) or designated representative for review
• Incorporate feedback from stakeholders
• Obtain formal approval before commencing the assessment
• The AO approves the plan and ensures it meets organizational requirements
Phase 4: Plan Execution
• Conduct the assessment according to the approved plan
• Collect evidence through examination, interviews, and testing
• Document findings for each assessment procedure
• Make determination statements for each control (satisfied or other than satisfied)
Phase 5: Reporting and Follow-Up
• Compile findings into the Security Assessment Report (SAR)
• Identify weaknesses, deficiencies, and recommendations
• Present findings to the AO and system owner
• Support the development of the Plan of Action and Milestones (POA&M) for remediation
Depth and Coverage Considerations:
An important aspect of plan development is determining the depth and coverage of the assessment:
• Depth refers to the rigor and level of detail of the assessment. It ranges from basic to focused to comprehensive. Higher-impact systems typically require greater depth.
• Coverage refers to the scope or breadth of assessment objects included. It also ranges from basic to focused to comprehensive. Greater coverage means more assessment objects (e.g., more devices, more personnel, more documents) are evaluated.
The depth and coverage should be commensurate with the system's impact level (Low, Moderate, or High) and the organization's risk tolerance.
Relationship to Other RMF Artifacts:
The assessment plan does not exist in isolation. It is closely related to:
• The System Security Plan (SSP) — which describes the controls to be assessed
• The Security Assessment Report (SAR) — which documents the results of the assessment
• The Plan of Action and Milestones (POA&M) — which tracks remediation of identified weaknesses
• The Authorization Package — which includes the SSP, SAR, and POA&M for the AO's authorization decision
Continuous Monitoring and Ongoing Assessments:
Assessment plan development is not a one-time activity. Under the continuous monitoring phase of the RMF (Step 6), organizations must develop ongoing assessment plans that specify:
• Which controls will be assessed and how frequently
• How assessment findings will be reported and tracked
• How changes to the system or environment will trigger reassessment
• Integration with the organization's Information Security Continuous Monitoring (ISCM) strategy
Independence Requirements:
For moderate and high-impact systems, NIST recommends that assessors maintain a degree of independence from the system being assessed. The assessment plan should clearly document the independence level of the assessment team. For low-impact systems, self-assessment by the system owner may be acceptable, but for higher-impact systems, independent assessors or third-party assessment organizations (3PAOs) may be required.
How to Answer Questions on Assessment and Audit Plan Development in an Exam
When facing exam questions on this topic, use the following strategies:
1. Understand the Purpose: Remember that the primary purpose of an assessment plan is to establish the scope, methodology, procedures, schedule, and responsibilities for evaluating security and privacy controls. If a question asks about the purpose, focus on ensuring controls are implemented correctly, operating as intended, and producing the desired outcome.
2. Know the Three Assessment Methods: Examine, Interview, and Test. Many questions will test your understanding of when each method is appropriate and what each involves. Remember: Examine = documents and artifacts; Interview = people and discussions; Test = hands-on execution and observation of mechanisms and activities.
3. Know the Four Assessment Objects: Specifications, Mechanisms, Activities, and Individuals. Questions may ask you to identify which type of object is being assessed in a given scenario.
4. Remember the Approval Authority: The Authorizing Official (AO) approves the assessment plan. This is a frequently tested concept.
5. Understand Depth and Coverage: Higher-impact systems require greater depth and coverage. If a question presents a high-impact system, expect the answer to involve comprehensive assessment procedures.
6. Distinguish Between Plan, Report, and POA&M: The assessment plan comes before the assessment, the SAR comes after, and the POA&M tracks remediation. Questions often test whether you can correctly sequence these documents.
7. Know the Key NIST References:
- NIST SP 800-53A: Assessing Security and Privacy Controls
- NIST SP 800-53: Security and Privacy Controls catalog
- NIST SP 800-37: Risk Management Framework
- NIST SP 800-137: Information Security Continuous Monitoring
Exam Tips: Answering Questions on Assessment and Audit Plan Development
✓ Tip 1 — Focus on the RMF Step: Assessment and audit plan development is primarily associated with Step 4 (Assess) of the NIST RMF. If a question references RMF steps, quickly identify that assessment planning belongs here.
✓ Tip 2 — Look for Keywords: When you see terms like scope, methodology, procedures, rules of engagement, or assessment team, the question is likely about plan development rather than execution or reporting.
✓ Tip 3 — Eliminate Distractor Answers: Common distractors include confusing the assessment plan with the SSP (which describes controls, not how they will be assessed), or confusing it with the SAR (which documents results, not the plan for assessment).
✓ Tip 4 — Remember Independence: If the question involves a moderate or high-impact system, the correct answer will likely emphasize assessor independence. For low-impact systems, self-assessment may be acceptable.
✓ Tip 5 — Think Risk-Based: The CGRC exam emphasizes risk-based approaches. The correct answer will typically be the one that prioritizes assessment activities based on risk, impact level, and organizational needs rather than applying a one-size-fits-all approach.
✓ Tip 6 — Sequence Matters: Remember the correct order: SSP development → Assessment Plan development → Assessment Plan approval by AO → Assessment execution → SAR development → POA&M development → Authorization decision. Questions often test your understanding of this sequence.
✓ Tip 7 — Stakeholder Roles: Know who does what:
- AO: Approves the assessment plan and makes authorization decisions
- SCA/Assessor: Develops and executes the plan
- System Owner: Provides access, documentation, and cooperates with the assessment
- ISSO: Coordinates and supports the assessment process
✓ Tip 8 — Continuous Monitoring Context: Some questions will test whether you understand that assessment plans must be updated and maintained as part of continuous monitoring, not just during initial authorization.
✓ Tip 9 — Scenario-Based Questions: For scenario questions, carefully read the details about system impact level, organizational policies, and specific control requirements. The assessment plan should be tailored to these specifics, not generic.
✓ Tip 10 — When in Doubt, Choose Comprehensiveness: If two answers seem equally correct but one is more comprehensive or includes more planning elements (such as scope, methodology, schedule, and roles), choose the more comprehensive option. The exam values thorough, well-documented plans over shortcut approaches.
Summary
Assessment and audit plan development is a critical process that lays the foundation for effective security and privacy control evaluation. By understanding its components, the process for developing and approving plans, the assessment methods and objects, and the relationship between key RMF artifacts, you will be well-prepared to answer CGRC exam questions on this topic. Always think in terms of risk-based prioritization, proper sequencing of activities, stakeholder responsibilities, and the appropriate level of depth and coverage based on system impact.
