Which role conducts testing of controls in RMF?

• A. RMF Lead
• B. Information System Owner
• C. Security Control Assessor (or assessors)
• D. Authorizing Official

Answer: (C)

Testing of controls in RMF is performed by Security Control Assessors. Their job is to carry out the security control assessment, gathering evidence through tests, inspections, and interviews to determine whether the controls are implemented correctly, operating as intended, and meeting the required standards. This independence from the system’s developers and owners helps ensure an objective evaluation, and the findings feed into the Assessment Report and the authorization decision.

The RMF Lead coordinates the process and ensures steps are followed, but does not serve as the tester in this context. The Information System Owner is responsible for the system’s operation and for ensuring that controls are implemented and maintained, providing information to support the assessment. The Authorizing Official makes the final risk-based decision to authorize operation, using the assessment results, but does not perform the testing themselves.