How are control assessments conducted?

• A. Control assessments are conducted in accordance with the security and privacy assessment plans.
• B. Opportunities to reuse assessment results from previous assessments to make the risk management process timely and cost-effective are considered.
• C. Use of automation to conduct control assessments is maximized to increase speed, effectiveness, and efficiency of assessments.
• D. Assessment results are not compared to previous cycles.

Answer: (A)

Control assessments are conducted in accordance with security and privacy assessment plans that specify the scope, criteria, methods, evidence requirements, and roles. This framework ensures consistency, defensibility, and repeatability across assessments, making adherence to the plans the correct description of how assessments are conducted. Other aspects like reusing results from previous assessments and using automation can enhance speed and efficiency and are commonly used, but they do not by themselves define how the assessments are performed. Also, assessment results are typically compared to previous cycles to monitor trends and improvements, so stating they are not compared would not reflect standard practice.