Which standard is commonly used as the basis for testing and assessing security controls?

• A. NIST SP 800-53
• B. NIST SP 800-53A
• C. ISO 27001
• D. PCI DSS

Answer: (B)

Security control testing relies on a dedicated assessment guide that outlines how to plan, perform, and document evaluations of controls. NIST SP 800-53A provides the procedures, methods, and evidence requirements used to assess the effectiveness of security controls defined in NIST SP 800-53. It covers assessment objectives, testing procedures, and how findings are reported, making it the go-to basis for formal assessments in many federal and regulated environments. The control catalog in NIST SP 800-53 lists what controls exist and how they map to families, but it does not prescribe how to test them. ISO 27001 focuses on establishing and maintaining an information security management system, not the specifics of evaluating each control. PCI DSS targets security requirements for payment card data in cardholder environments and includes its own testing requirements tailored to payment ecosystems. But when the question asks for the baseline used to test and assess security controls, the assessment guide associated with those controls is the 800-53A document.