Within the NIST SP 800-37 based certification and accreditation methodology, the four Security Control Assessment Tasks proceed as: Task 1, prepare for the assessment; Task 2, assess the operational, technical, and management security controls of the information system using the assessment procedures and measures that were selected or developed for that purpose; Task 3, produce the Security Assessment Report documenting the results; and Task 4, undertake initial remediation actions. Because evaluating the controls by applying the chosen assessment techniques and measures is precisely what Task 2 performs, it is the task being described.
Community Discussion