Perform Control Assessment

This guide outlines how to perform formal control assessments covering both Design Adequacy and Operating Effectiveness.

---

1. Evaluating Design Adequacy (CM-4)

1. Navigate to Controls & Assurance > Assessments > Design Assessment (/assess).
2. Select the crosswalk mapping between the control and requirement.
3. Review the obligation requirements and the control's design specifications.
4. Record the design verdict:
   • Adequate: Control design satisfies the full intent of the obligation.
   • Partially Adequate: Minor design gaps exist.
   • Inadequate: Flawed design requiring modification.
5. Provide detailed rationale and click Submit Design Assessment.

---

2. Testing Operating Effectiveness

1. Navigate to Controls & Assurance > Assessments > Control Testing.
2. Define the Test Scope & Population (e.g., sample of user access revocations over Q2).
3. Review attached evidence samples and document test procedures.
4. Record testing results:
   • Effective: No sample exceptions observed.
   • Ineffective: Systemic failures observed.
5. If testing fails, click Raise Finding to immediately create a linked FND-YYYY-NNNN deficiency record.