Module 5 Assessment
What you will be able to do
- Explain examine, interview, and test, and choose methods for a control using NIST SP 800-53A.
- Break a control into determination statements.
- Build an evidence request list and track it to completion.
- Write a satisfied and an other-than-satisfied finding with evidence references.
- Explain assessor independence and what an ISSO does before, during, and after an assessment.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. What an Assessment Is, and the ISSO's Part in It · 35 min Completed
- 2. Methods, Objects, and Determination Statements · 45 min Completed
- 3. The Assessment Plan and the Evidence Request · 40 min Completed
- 4. Writing Findings · 45 min Completed
- 5. The Assessment Report and What Happens Next · 35 min Completed
Practice and quiz
- Practical exercise: Assess Five TreasuryFlow Controls
- Module quiz (10 questions, pass mark 80 percent)
Overview
In Module 4 you wrote the claims. In this module they are tested. It covers the Assess step of the Risk Management Framework: how assessors decide what to check, how they check it, how results are written, and what happens to them afterward.
You will learn it from both sides. An Information System Security Officer (ISSO) does not assess their own system for the record, but prepares for assessments, supports them, reviews the results, and uses exactly the same method for self-checks and ongoing monitoring. Many ISSOs later become assessors, and the skills are the same.
Builds on
- Module 4, Lesson 2: implementation statements. A statement that answers the four questions is one that can be assessed.
- Module 4, Lesson 5: the evidence index, which becomes the answer to most evidence requests.
- Module 3, Lessons 1 and 4: parameters and tailoring. Assessors test against the values you assigned and the control set you tailored.
- Module 1, Lesson 3: the assessor's role and independence.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | What an Assessment Is, and the ISSO's Part in It | 35 min | New |
| 2 | Methods, Objects, and Determination Statements | 45 min | Adapted from existing material |
| 3 | The Assessment Plan and the Evidence Request | 40 min | Adapted |
| 4 | Writing Findings | 45 min | Adapted |
| 5 | The Assessment Report and What Happens Next | 35 min | New |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FISMA | Binding statute | Requires periodic testing and evaluation of controls, no less than annually |
| OMB Circular A-130 | Binding policy | Requires control assessments and independent assessment appropriate to risk |
| NIST SP 800-53A | Guidance, required in practice | Supplies assessment procedures; applied through Circular A-130. Organizations may tailor procedures |
| NIST SP 800-37 (Assess step) | Guidance, required in practice | As above |
| NIST SP 800-53, controls CA-2, CA-5, CA-7 | Guidance, required in practice | Once selected and in the approved plan, they are commitments |
| NIST SP 800-30, SP 800-115 | Guidance | Risk assessment and technical testing methods |
| Depth and coverage values | Organization's choice | NIST defines the attributes and leaves the values to the organization |
| The approved assessment plan | Binding on the assessment | It is what the authorizing official's office approved |
| Government Auditing Standards (the "Yellow Book") | Binding on government auditors | Source of the four elements of a finding; used here as good practice, not as a requirement on ISSOs |
| SOC 2 reports | Not federal authority | Supporting evidence only |
| FedRAMP assessor requirements | Binding within FedRAMP | Covered in Module 8 |
Module summary
- An assessment decides whether each control is implemented correctly, operating as intended, and producing the desired outcome.
- Results are satisfied or other than satisfied. Evidence that cannot be produced means other than satisfied.
- Assessors work from determination statements. One failing statement fails the control.
- Examine, interview, and test complement one another. Test is the strongest evidence that a mechanism works.
- The assessment's scope must come from the system's tailored control set. The assessor chooses the sample.
- Good evidence is relevant, current, attributable, complete, direct, and system-generated where possible.
- A finding states condition, criterion, cause, and effect. Correct factual errors; record mitigations; never ask for a true finding to be removed.
- Fix what can be fixed and have it re-checked. Everything else goes into the plan of action and milestones. No finding lives outside it.
What comes next
Module 6 takes the security plan, the assessment report, and the list of open weaknesses, assembles them into an authorization package, and follows it to the authorizing official's decision.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.