Capstone: building an assessment and testing program

The earlier lessons treated each kind of assessment on its own: strategies, scoping and authorization, vulnerability management, scoring, penetration testing, control testing, log review, software testing, audits, process data and reporting. In practice they must work together as a program, planned over a year, resourced, independent where it needs to be, and producing results that management uses. This capstone builds such a program for an invented organization, then closes with strategies for Domain 6 questions on the exam.

The organization, its numbers and its people are invented for teaching. The regulatory context differs between the two versions of the course, and the figures are illustrative.

The organization

Westbrook Credit Union is an invented credit union based in Manitoba with 240,000 members, 38 branches, 1,100 employees and a growing digital banking platform. It is regulated provincially, holds personal information subject to PIPEDA, processes payment cards through a third-party processor and runs a mix of on-premises systems and cloud services hosted in Canada. Its board's risk committee has asked for an assessment and testing program that gives it confidence in the credit union's security controls and satisfies its regulator, its card processor and its external auditor.

The chief information security officer (CISO) has a team of nine, an internal audit function of four that reports to the board's audit committee, and an operating budget for external assurance. The credit union has never had a structured program: it has commissioned an occasional penetration test, runs a vulnerability scanner with no defined service levels, and collects evidence for audits in a hurry each year.

Step 1: define objectives and requirements

A program starts from what it must achieve. The CISO gathers the requirements that drive assessment work: regulatory expectations, contractual obligations to the card processor (PCI DSS validation), the external auditor's reliance on IT general controls for the financial statement audit, the board's risk appetite statements, and the credit union's own top risks from its risk register, which name ransomware, account takeover of members, third-party failure and insider misuse.

Step 2: assign roles and protect independence

Different activities need different degrees of independence. Day-to-day vulnerability scanning and continuous control monitoring belong to the first line, the security and IT teams that run the controls. Oversight, metric validation and challenge belong to the second line, a risk management function. Independent assurance belongs to the third line, internal audit, and to external parties. The CISO must not commission audits of the CISO's own controls and present them to the board as independent; internal audit or an external firm engaged by the audit committee should perform those.

Step 3: build the annual plan

The annual plan schedules each activity, assigns an owner and links it to its driver. Frequencies follow risk and requirements: continuous for scanning and monitoring, quarterly for external scans and access reviews, annual for penetration tests and major audits, and after significant change for targeted testing. The plan also leaves capacity for unplanned work, such as a test after a major system change or an audit requested by the board after an incident elsewhere in the sector.

Step 4: budget the external work

External assurance costs money, and the plan must fit the budget. The CISO estimates costs for each external activity from market quotes, adds a contingency and compares the total with the budget. The figures below are illustrative; real prices vary widely by scope, region and provider.

# Illustrative annual budget for external assessment work (CAD or USD; same figures for both versions)
items = {
    'External and internal penetration test incl. segmentation': 85_000,
    'Targeted retest after remediation': 15_000,
    'ASV quarterly external scans (4)': 8_000,
    'Ransomware exercise facilitation': 22_000,
    'Independent assessment of security program': 60_000,
    'Specialist support for internal audit (co-source)': 45_000,
}
subtotal = sum(items.values())
contingency = round(subtotal * 0.15)
total = subtotal + contingency
budget = 260_000
for name, cost in items.items():
    print(f'{name:60s} {cost:>9,}')
print(f'{"Subtotal":60s} {subtotal:>9,}')
print(f'{"Contingency 15% for change-driven testing":60s} {contingency:>9,}')
print(f'{"Total":60s} {total:>9,}')
print(f'Budget {budget:,}: {"within budget" if total <= budget else f"over by {total - budget:,}"}')

External and internal penetration test incl. segmentation       85,000
Targeted retest after remediation                               15,000
ASV quarterly external scans (4)                                 8,000
Ransomware exercise facilitation                                22,000
Independent assessment of security program                      60,000
Specialist support for internal audit (co-source)               45,000
Subtotal                                                       235,000
Contingency 15% for change-driven testing                       35,250
Total                                                          270,250
Budget 260,000: over by 10,250

The plan comes in over budget. The CISO's options are to ask the board for more funding with a clear explanation of the risk each item addresses, to rescope (for example, alternating the independent program assessment every second year with an internal audit in between), or to bring some work in-house where independence allows. The decision belongs to the risk committee, and the CISO's job is to present the trade-off clearly rather than quietly drop activities.

Step 5: define the metrics and reports

The program needs a small set of headline indicators for the board and a larger set for management. For Westbrook, the CISO proposes eight board metrics, each with a definition, data source, target and threshold, reported quarterly with four quarters of trend: critical and high vulnerabilities on internet-facing systems remediated within SLA; known exploited vulnerabilities open beyond 14 days; leavers disabled within one business day; privileged accounts with phishing-resistant MFA; critical systems with a successful restore test in the last 12 months; logging coverage of critical systems; open high-risk audit findings past due; and active security exceptions by residual risk.

# Quarterly board scorecard: current value, target and direction (illustrative)
metrics = [
    # name, current, previous, target, higher_is_better
    ('Internet-facing crit/high fixed within SLA (%)', 88, 81, 95, True),
    ('KEV items open beyond 14 days (count)',           3,  7,  0, False),
    ('Leavers disabled within 1 business day (%)',     91, 86, 98, True),
    ('Privileged accounts with phishing-resistant MFA (%)', 74, 52, 100, True),
    ('Critical systems restore-tested in 12 months (%)', 67, 58, 100, True),
    ('Critical systems sending logs centrally (%)',     94, 88, 100, True),
    ('High audit findings past due (count)',            2,  5,  0, False),
    ('Active high-risk exceptions (count)',             4,  4,  2, False),
]
for name, cur, prev, target, up in metrics:
    improving = (cur > prev) if up else (cur < prev)
    trend = 'improving' if improving else ('flat' if cur == prev else 'worsening')
    met = (cur >= target) if up else (cur <= target)
    status = 'on target' if met else 'below target'
    print(f'{name:52s} {cur:>4} (prev {prev:>3}, target {target:>3})  {trend:9s} {status}')

Internet-facing crit/high fixed within SLA (%)         88 (prev  81, target  95)  improving below target
KEV items open beyond 14 days (count)                   3 (prev   7, target   0)  improving below target
Leavers disabled within 1 business day (%)             91 (prev  86, target  98)  improving below target
Privileged accounts with phishing-resistant MFA (%)    74 (prev  52, target 100)  improving below target
Critical systems restore-tested in 12 months (%)       67 (prev  58, target 100)  improving below target
Critical systems sending logs centrally (%)            94 (prev  88, target 100)  improving below target
High audit findings past due (count)                    2 (prev   5, target   0)  improving below target
Active high-risk exceptions (count)                     4 (prev   4, target   2)  flat      below target

The scorecard tells a clear story: every metric but one is improving, none has yet reached its target, and the number of high-risk exceptions has not moved. A board member reading it knows where progress is happening and which item to ask about. Detailed findings, remediation lists and exception registers sit beneath it for management.

Step 6: run, review and improve

Once running, the program needs its own governance. Results from each activity flow into the remediation tracker and the risk register. The second line validates a sample of metrics twice a year. Internal audit periodically audits the assessment program itself: are activities happening as planned, are findings tracked to closure, are exceptions controlled? At year end, the CISO reviews what each activity found and what it cost, and adjusts the next plan: activities that repeatedly find nothing may be reduced in frequency, while areas with recurring findings may need more testing or a different approach.

Exam strategy for Domain 6

Domain 6 questions usually describe a situation and ask what to do first, what is best or what is most appropriate. They reward a manager's judgement over a technician's instinct. A few patterns recur.

When two answers both seem right, ask which one a manager responsible for risk, accountable to a board and bound by law and ethics would choose. Authorization comes before testing, design before operation, evidence before conclusions, independence for assurance, and risk-based priorities for everything. Read the question for words like first, best, most and least, and for clues about the role you are playing: an auditor, a CISO or a system owner may each have a different correct answer.

This course is independent study material aligned with the CISSP Domain 6 outline in force since 15 April 2024 (checked October 2026). Canadian learners preparing for the exam should also confirm current exam registration details and any accommodations with the testing provider, and may find chapter events of local ISC2 and ISACA communities useful for study groups.