Security Control Assessment (SCA) Process Overview

In this video we looked at how to prepare for a Security Control Assessment (SCA). What we need to do before, during and after the Assessment.
Security Assessment Plan (SAP): - This document clearly defines the process, procedures, and methodologies for testing Information System Security Controls.
Security Assessment Reports (SAR): - This documents is used to document all the results of the testings and assessments conducted. It also clearly defines the process, procedures and methodologies utilized for testing and assessing the security controls of an Information System.
FedRAMP Documents and Templates
www.fedramp.gov/documents-tem...
Computer Security Resource Center
csrc.nist.gov/publications
The free way to help the channel grow is by subscribing using the link below:
czcams.com/users/KamilSec?su...
************Patreon & Channel Support******************
www.patreon.com/kamilSec?fan_...
*******Order your KamilSec (KS) Designs Merch:*********
kamilsec.creator-spring.com/
**************************************************************
CashApp: $Kamilzak
Zelle: [e-mail]
Paypal: paypal.me/MZakari
Thank You!!!
*************************************************************
*I ALSO CONDUCT INDIVIDUALIZED RESUME AND INTERVIEW PREP SESSION*
Connect with me on Social Media:
Twitter: / kamilzak_1​
Instagram: @Kamilzak1

[@lawrencemichael6002]

Kamil, you are just a generous genius. Bless your heart in the good work you continue to do and life you touch globally. Thank you champ.

[@KamilSec]

Thank you, I appreciate that!!!

[@poshtecconsults8]

A great teachable moment. Thank you Prof.

[@KamilSec]

You are very welcome, Portia.

[@germainkone9029]

So thankful. Anytime that I am lost a little bit I come over here and I walked out so satisfied . Thanks again 🙏

[@KamilSec]

You are so welcome

[@germainkone9029]

@@KamilSec Please tell me what how far in details and how many minutes should I go with Tell me about yourself question ! After watching so many videos with no clear answer , here I am again seeking for some tips. Thanks again in advance. 🙏

[@Risklearner]

Thank you for the video. So helpful to understand the SCA process.

[@KamilSec]

Glad it was helpful!

[@leviteshouse7213]

Great job as usual Prof👍

[@KamilSec]

Thanks Sir!

[@realchanger8220]

Very very helpful. Thank you

[@KamilSec]

Glad it was helpful!

[@elvistuffour1731]

Great content, Legend!

[@KamilSec]

Thanks Elvis!

[@Fidelisinspire]

Excellent content and presentation. I'm using this to prepare for an upcoming SCA interview. Thank you so much brother!

[@KamilSec]

Best of luck!

[@Nsorkwame]

Thanks sir, very informative as usual 👌🏼

[@KamilSec]

You're welcome Kwame, thanks!

[@user-vb8nc5cf5q]

Thank you for such a great presentation. Very informative and helpful. 👍

[@KamilSec]

Glad it was helpful!

[@sjames916]

Gold! Kamil laying out the blueprint to get into security compliance.

[@XX2LFEUSNVET]

Appreciate it learned more here than on my project team, like they're trying to sabatosh me on purpose.

[@KamilSec]

I am glad it was helpful!

[@ALLISONFolks]

amazing content sir, extremely helpful. Thank you

[@KamilSec]

Most welcome Allison!

[@adedolaadediran4712]

such great information.Thanks Kamilsec. Am a new subscriber

[@KamilSec]

You're very welcome Adedola, and thanks for being a subscriber on the channel!

[@princenanafosu8161]

Good job .thanks👍

[@KamilSec]

You're Welcome 👍

[@iyamahsylva7316]

Good training and program

[@KamilSec]

Thanks!

[@AdeleClarice]

Thank you for the video.. very helpful.

[@KamilSec]

You're very welcome! Glad it was helpful!

[@AdeleClarice]

@@KamilSec do you have some form of training? I just got a job as a SCA... I need some more help.

[@FM-zp2hl]

Amazing content

[@KamilSec]

Thanks!

[@algbla6042]

Great presentation on preparation for control assessment. Definitely learned a lot from this.

[@KamilSec]

Awesome, I am glad to hear that Alhaji, Thanks!

[@benjaminacquaye6444]

🙏

[@annetish1205]

Awesome- God bless u

[@KamilSec]

Thank you so much, Anne.

[@annetish1205]

How do I contact you?

[@KamilSec]

[e-mail]

[@sidalpha2000]

good info

[@KamilSec]

Thanks

[@estheranddemiyaforsang6171]

Awesome video Sir! Can you share the artifact list, please?

[@cgao5599]

Share a complete ATO package video.

[@lachampagnia]

Hello. Do you offer interview prep classes?

[@juddybest1612]

The best teaching. Thanks a lot. Question: What skills or qualities are expect by an Organization from a newly hired SCA who has no prior practical/ field knowledge of the job? For instance, one who just graduated from the college.

[@KamilSec]

Usually, they prefer to hire candidates with at least few years of experience.

[@RodThePRConsult]

Awesome presentation... Thank you.. I have a question, how often should Security Assessment Report be updated?

[@KamilSec]

New SARs are only created after every Security Control Assessment (SCA). SAR are updated when/if after the SCA and a finding was disputed, and the assessors agree, then they will update the SAR. Hope that makes sense.

[@abdulzar1050]

Thanks a lot for this presentation. It a has vicarious feel to it. Can you do on risk assessment?

[@KamilSec]

I am sure I have something on Risk Assessment on the channel as well.

[@abdulzar1050]

@@KamilSec thanks

[@farahatiqah9988]

Great presentation! Is there any sources or guidance from NIST on artifacts request list? For eg if Access Control Family is being assessed, what are the list of artifacts should be requested? Thanks!

[@KamilSec]

Unfortunately no. This has to be developed by the assessment team members.

[@maxwellaburam4911]

Great Video.
Do you have a video on how to develop a test plan for assessing security controls./Control Correlation I identifier (CCI)?

[@KamilSec]

Not yet, will do that soon.

[@CFH298]

This was would be an awesome video. Thanks!

[@jesl3nt64]

I have a question what are some of the monitoring tools afther Accessment is done

[@KamilSec]

Well depending on the agency, SIEM tools like Splunk, QRadar as well as Vulnerability scanning tools like Nessus, WebInspect, DBProtect, NexPose etc. can be used to assist in the Continuous Monitoring.

[@atohambe5775]

Hi Kamilsec. I will like to join your class for training.
When is the next cissp class?

[@KamilSec]

Not conducting training currently.

[@AlmondHealthcareServicesLLC]

great video's, do you have training classes?

[@KamilSec]

Not yet...

[@uche2564]

What are some common problems you would run into during an assessment ?

[@KamilSec]

1. Clients not providing artifacts/evidence on time
2. Clients deliberately providing wrong artifacts/evidence
3. Clients refusing to accept findings and so on....

[@uche2564]

@@KamilSec Thankyou! One last question. As an assessor, what are your options or next steps if a client refuses to accept the findings

[@cricriy1400]

Is this work a team work or a self work?

[@KamilSec]

Yea, the SCA is a team work

[@joycefynn8496]

Well done prof! How can I contact you please?

[@KamilSec]

[e-mail]

[@tanveerahmed9494]

Hi, can u pls share the artifact request list

[@KamilSec]

There is a link to my Patreon page in the video description where you can find all documents I used in my videos.

[@jackybandoh7335]

Quick question
What’s the difference between security assessment and risk assessment?

[@KamilSec]

I will say Security Assessment can be a subset of Risk Assessment. Because in Risk Assessment, every aspect of the business or the organization such as financial, marketing, competitive advantages etc. of the business will be evaluated and reviewed, where as Security Assessment can be just limited to security operation.

[@jackybandoh7335]

Thanks

[@maryniang7683]

How can you be reached?

[@KamilSec]

[e-mail]

[@dinayenbelirta4213]

Great one,Can you be my Mentor sir

[@KamilSec]

[e-mail]

[@ITSS.MEEEEEEE]

Hi uncle

[@KamilSec]

Hi Zee Zee, How are you? I hope you are reading your books.

[@ITSS.MEEEEEEE]

I think so