ABC Company uses technical compliance tests to verify that its IT systems are configured according to organizational information security policies…

Technical compliance tests are designed to verify that IT systems are configured in accordance with established security policies and standards.

Performing vulnerability assessments and penetration testing (C) are active methods to test system configurations and security controls. Vulnerability scanning checks systems against databases of known vulnerabilities, which often result from misconfigurations, while penetration testing attempts to exploit such weaknesses. Both serve to verify if the system's security posture complies with policy objectives.

Implementing baseline configuration security controls (D) establishes a formal, documented standard for system settings. Compliance is then verified by regularly scanning systems and comparing their current state against this approved baseline, ensuring they have not deviated from the required secure configuration.

A. Implementing Automated Key Management Procedures: This is a specific control for managing cryptographic keys, not a general method for testing overall system configuration compliance.

B. Implementing Automated Human Resource Procedures: This relates to personnel security and administrative controls, not the technical configuration and compliance testing of IT systems.

1. NIST Special Publication 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations.

Control CM-2 (Baseline Configuration): This control requires organizations to develop and maintain a baseline configuration for systems. The discussion section notes

"Baseline configurations serve as a basis for future builds

releases

and/or changes to information systems...and for assessing the security state of systems." (Page 153)

Control RA-5 (Vulnerability Monitoring and Scanning): This control mandates scanning for vulnerabilities. This is a direct technical test to ensure the system complies with security requirements

such as being free from known configuration-related vulnerabilities. (Page 233)

Control CA-8 (Penetration Testing): This control requires penetration testing

which is described as a specialized type of assessment to identify vulnerabilities. This verifies the effectiveness of implemented controls against policy. (Page 149)

2. NIST Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems.

Section 2.5 (Monitor and Report on the Security Configuration of Information Systems): This section explicitly states

"Monitoring involves checking and assessing information systems to determine if they are still in compliance with their documented secure configurations." This directly links monitoring/testing to baseline configuration compliance. (Page 13)

3. NIST Special Publication 800-115

Technical Guide to Information Security Testing and Assessment.

Section 1.2 (The Role of Security Testing and Examination): This section states that security testing and assessment "can be used to validate compliance with a specific security policy or other requirements." It further identifies vulnerability scanning and penetration testing as key assessment techniques. (Page 1-2)