Domain 6 · Objective reference 6.1 · Chapter 38 of 62
Design an assessment, test and audit strategy
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A test answers a question; an audit evaluates against criteria.
Explore the anchors
Define the claim and acceptance criteria.
Concept matching activity
Match this task or description to its concept:
Select testing assessment or audit procedures.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
An assessment strategy states which claim is being evaluated, the service and period, relevant requirements and evidence. Internal, external and third-party work differ in relationship and independence; on-premises, cloud and hybrid environments differ in access and shared responsibility. A vulnerability scan, a penetration test and an operating-effectiveness assessment answer different questions.
Design, evidence and tradeoffs
Choose methods, populations, sampling, competence and independence appropriate to the objective. Establish authorization, safe conditions, reporting and remediation routes. Data availability can limit the conclusion, so preserve scope limitations rather than imply untested completeness. Integrate assurance with lifecycle and material-change triggers. An organization can combine methods without describing every review as a full independent audit.
Worked example
A service recovery review includes backup evidence and an actual restore because job completion alone cannot support the recovery claim.
Check your understanding
What should be defined before selecting a testing tool?
Show explanation
The objective, scope, evidence needed, authority and conditions that make the conclusion defensible.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.