Adversarial control testing
A control tester attacks every preventive control daily in test, and each attempt is recorded as a refused Action.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC4.1 | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. |
| ISO27001 A.5.35 | The approach to information security is reviewed independently at set intervals and after significant changes. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every preventive control, in each report period. |
| Assert | Each has an unchanged Guard Version, zero bypass Events, and at least one refused test attempt. |
Owner
Example
Each day the tester tries to send a refund over the Billing Specialist's $100 Limit in test. The attempt ends refused, the Guard Version is unchanged, and the refused Action counts as that day's evidence.