Assessment and Audit

NIST (National Institute of Standards and Technology) provides the following definitions for each. First, it defines a security audit as an independent assessment of a system's records and activities to evaluate the effectiveness of system controls, confirm compliance with established security policies and procedures, identify violations of security services and suggest any modifications necessary to remedy this. And secondly, it describes a security assessment as the process of testing and/or evaluating management, operational and technical security controls in an information system to see how well they are implemented, functioning as planned and produce the desired results with respect to system security requirements. The first difference is that a security assessment aims to ensure that the security control in your organization or part of it is working as intended and provides a decision based on that. In contrast, a security audit checks your organization's security measures against a standard or set of standards. Another difference is that the security audit may contain different security assessments, including a vulnerability assessment and/or an access control assessment. Finally, the outcome of a security audit recommends changes to your organization's security control with countermeasures.