CISSP Domain 6: Security Assessment and Testing explained

Domain 6 at a glance

The subdomains in plain words

1. 6.1 Assessment, test and audit strategy: the difference between a test, an assessment and an audit; internal, external and third-party work; how often to test.
2. 6.2 Control testing: vulnerability scans, penetration tests, code review, fuzzing, misuse cases, synthetic monitoring and exercises.
3. 6.3 Security process data: account reviews, backup checks, key performance and risk indicators, training metrics and continuous monitoring.
4. 6.4 Analysing and reporting results: validating findings, prioritising remediation, handling exceptions and ethical disclosure.
5. 6.5 Audits: audit types, standards, and service organisation (SOC) reports.

What the exam tends to test

• Written authorisation first. No test starts without senior management's approval in writing.
• Independence. When results must convince outsiders, use an independent assessor. A team cannot audit its own controls.
• The right method for the goal. Scan for known flaws, penetration test for real impact, fuzz for unexpected input, synthetic transactions to catch outages before users do.
• Results lead to decisions. Findings are validated, prioritised with business context and owned by the risk owner.
• Evidence over assurance. A real restore proves a backup; a log entry does not.

How deep to go

You will not run tools in the exam. You need to know what each technique reveals, what it misses and what it risks, so you can choose between them. Expect to judge reports and metrics too: does an indicator measure the right thing, and does a report's level of detail suit its audience? Senior leaders want risk in business terms, not scanner output.

Common traps

• Treating a scan as a penetration test. A scan finds candidate weaknesses; a penetration test tries to exploit them.
• Ranking by CVSS alone. Severity matters, but so do likelihood, exposure and the asset's value to the business.
• Forgetting false negatives. A missed real problem is the dangerous error, not a false alarm.
• Choosing the wrong SOC report. SOC 1 is about financial reporting, SOC 2 gives detailed security assurance under NDA, SOC 3 is the public summary; Type II shows controls worked over a period.
• Skipping the retest. The vulnerability workflow is not done until the fix is verified.

How to study it

1. Build a three-column table: test, assessment, audit. Fill in purpose, who performs it and who receives the result.
2. For each testing method, write one sentence on the question it answers. That is how the exam frames them.
3. Practise reading a short finding and deciding what the manager does next: accept, fix, transfer or escalate.
4. Tie this domain back to Domain 1, where risk decisions are owned, and forward to Domain 8, where code testing happens.
5. If you work in internal audit or a Big Four practice in Mumbai or Gurugram, this domain will feel familiar. Spend the saved hours on Domain 3.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. An approved penetration test finds a serious weakness on the payment server two days before a festive-season sale, the busiest week of the year. What should the security manager do?

• Take the server offline until the weakness is fixed.
• Patch it immediately, without testing, to close the hole.
• Validate the finding, then report it with the business impact and options to the risk owner, who decides on a fix, a delay or compensating controls.
• Keep quiet until after the sale to avoid disruption.

The reasoning. Taking the server offline might be the right outcome, but it is not the security manager's decision to make alone, and it costs the business its biggest week. Patching without testing trades one risk for another and bypasses change control. Hiding the finding is never acceptable. Validating first avoids acting on a false positive; then the risk owner, armed with facts and choices such as a web application firewall rule as a stopgap, makes an informed decision. Test results exist to support decisions, which is the thread through this whole domain.

Next steps

Check how Domain 6 compares on the domains overview and practise with our own practice questions.