thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Assessment Methods

The three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).

Definition

Examine involves reviewing documents, configurations, and records; interview gathers information from staff; test exercises controls under specified conditions to compare actual to expected behavior. CMMC assessments use the same three methods per SP 800-171A. Combining methods increases assurance.

Example

An assessor tests account lockout by attempting failed logins beyond the threshold.

Exam tip

Testing provides the strongest evidence among the three.

Related terms