Objective 5.5: Explain types and purposes of audits and assessments

Cert: CompTIA Security+ (SY0-701) Domain: 5.0 Security Program Management and Oversight Weight: ~20% of SY0-701 (Domain 5 total) Depth: Understand / Apply. Define the vocabulary, pick the right audit or pen test type for a given scenario, and explain why each one exists.

What this objective tests

You should be able to define attestation, name the internal and external audit types CompTIA lists, name the seven penetration testing types, and tell the difference between passive and active reconnaissance. The exam tests by scenario. You get a short story about a company, a regulator, or a tester, and you pick the right category. The objective is heavy on vocabulary. The exam pulls language from NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment), NIST SP 800-53A (Assessing Security and Privacy Controls), and PCI DSS audit requirements.

Three pitfalls account for most lost points on this objective. First, students confuse a self-assessment with an internal compliance audit. They are different. A self-assessment is the team scoring itself. An internal audit has independence from operational management. Second, students write white box, grey box, or black box on the exam. CompTIA has moved to known, partially known, and unknown environment. The exam tests the new vocabulary. Third, students treat passive reconnaissance as the lazy version of active reconnaissance. It is not. Good passive recon often defines the success of the engagement.

Key facts

Attestation

Attestation is a formal statement, signed by someone with authority, that a control or fact is true. It is the quiet base layer of every compliance report. When an executive signs a SOC 2 management assertion, the executive is attesting that the controls described in the report are in place. When a system owner signs an annual access certification, the owner is attesting that every account on the list still needs access. AICPA examinations rely on attestation because not every fact can be re-verified by an auditor by hand. SP-4.6 (IAM) and SP-5.4 (compliance) both reference attestation, so it shows up in three places on the exam.

Plain English: "I am signing my name to say this is the case."

Internal audit work

CompTIA lists three flavors of internal audit work on the SY0-701 objective.

Compliance audit. An internal team checks whether the organization is meeting a specific framework or rule. Owners are typically an internal audit department or a GRC (Governance, Risk, and Compliance) team. The framework can be HIPAA, NIST CSF, ISO 27001, or a contract obligation. The output is a list of findings tied to control IDs, scored against the standard.

Audit committee. A board-level group that oversees the audit function. The audit committee reads audit reports, asks management questions, and signs off on the annual audit plan. The committee exists so an audit finding can reach the board without management filtering. Public companies are required to have one under the Sarbanes-Oxley Act. Private companies and non-profits often have one anyway because it improves the quality of the audit work.

Self-assessment. The organization scores itself against a framework on its own initiative. Common frameworks are NIST CSF 2.0, CIS Critical Security Controls, and HIPAA Security Rule risk analysis. Self-assessments are cheaper and faster than audits and useful as preparation. They are not a substitute for an independent audit. The reporting line does not bypass operational management, which is the structural difference between a self-assessment and an internal audit.

External audit work

CompTIA lists four flavors of external audit work on the SY0-701 objective.

Regulatory audit. Run by or on behalf of a government regulator. Bank examiners from the FDIC, OCC, NCUA, or state banking departments under FFIEC guidance. Hospital audits by the HHS Office for Civil Rights under HIPAA. School audits by state education agencies under FERPA. Public company audits by the SEC and the PCAOB. The regulator can compel evidence and can issue findings with legal consequence.

Examinations. Structured external reviews that follow a defined published methodology and produce a defined opinion. AICPA SOC 1 and SOC 2 (Type I and Type II) are examinations. PCI DSS Report on Compliance is an examination by a PCI Qualified Security Assessor (QSA) firm. FFIEC IT examinations are examinations. ISO 27001 certification audits are examinations. Examinations produce a formal opinion, which is the structural difference between an examination and an open-ended assessment.

Assessment. A broader external review that may not produce a formal opinion. A NIST CSF gap assessment. A security maturity assessment. A red team engagement report. The assessor does not certify the organization. The assessor produces findings, recommendations, and sometimes a maturity score, but no pass-or-fail statement under a published standard.

Independent third-party audit. An audit by a firm that has no operational or financial stake in the organization being audited. A CPA firm performing a SOC 2 audit is an independent third-party auditor. An ISO 27001 certification body is an independent third-party auditor. A PCI QSA firm is an independent third-party auditor. The structural test: is the auditor employed by, paid by, or otherwise dependent on the organization being audited. If yes, the work is not independent.

A single engagement can be more than one of these at the same time. A SOC 2 Type II from a CPA firm is an examination, an independent third-party audit, and (depending on contract) part of a customer-driven assessment. The categories overlap by design.

Audit vs assessment, in two sentences

Audit measures against a defined standard. Assessment measures the program overall.

Penetration testing

A penetration test is an authorized simulated attack against a system to find exploitable weaknesses. The activity is bounded by a rules-of-engagement document. NIST SP 800-115 is the canonical methodology. CompTIA splits penetration testing into seven types on the SY0-701 objective.

The exam tests pen test types by scenario. Most questions give a short story and ask which type fits.

CompTIA-current environment vocabulary (memorize)

The SY0-701 exam writes known environment, partially known environment, and unknown environment. Old white-grey-black box vocabulary still appears in the wider industry but Sec+ uses the new phrasing. Lock this in.

Speed and surprise trade off across the three environments. Known environment is fastest and deepest. Unknown environment is most like a real attack and is the slowest. Partially known sits in the middle and is the common pick for the second engagement after a known baseline.

Reconnaissance

Reconnaissance is the information-gathering phase of a penetration test or attack. The SY0-701 objective splits reconnaissance into two kinds.

Passive reconnaissance collects information without touching the target. WHOIS lookups, public DNS records, Shodan searches, Google dorks, LinkedIn searches, the Wayback Machine. Passive recon does not generate traffic that hits target systems. It is always legal against any organization on the open internet.

Active reconnaissance sends packets to the target. Port scans with Nmap, banner grabs, web crawling with Burp Suite or OWASP ZAP, ping sweeps, vulnerability scans with Nessus, Qualys, or OpenVAS. Active recon generates traffic that hits target systems. It requires signed rules of engagement. Without authorization, active reconnaissance crosses the line into unauthorized access under the federal Computer Fraud and Abuse Act and equivalent state and international laws.

Plain English: passive recon is reading the newspaper, active recon is knocking on the front door.

Rules of engagement

The rules-of-engagement document is the safety net of every authorized test. The standard fields:

• Scope (which systems are in)
• Out of scope (which systems are off limits)
• Test window (dates and times allowed)
• Authorized testers and their contact information
• Authorized internal contact for emergencies
• Permitted activities (e.g., password spray, web exploitation, phishing simulation)
• Forbidden activities (e.g., destructive actions, denial of service against production)
• Evidence handling rules
• Reporting cadence and final report due date
• Legal authorization signed by a person with binding authority

The rules of engagement protect both sides. They keep the tester out of jail and keep the customer from finding the tester pivoting somewhere unexpected.

NIST SP 800-115 anchor

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) is the canonical methodology for security testing in the United States. It defines three categories of testing activity: review (passive analysis of documentation, configurations, and logs), target identification and analysis (active scanning to identify hosts, services, and vulnerabilities), and target vulnerability validation (exploit attempts to verify findings). Students do not need to memorize section numbers, but the publication is worth recognizing on sight.

NIST SP 800-53A anchor

NIST SP 800-53A (Assessing Security and Privacy Controls in Information Systems and Organizations) is the assessment methodology for the SP 800-53 control catalog. Federal systems and many state and local systems under FedRAMP and StateRAMP use SP 800-53A to score each control as Satisfied, Other-than-Satisfied, or Not-Applicable. Sec+ rarely asks about specific 800-53A procedures, but the publication is part of the audit ecosystem to know.

PCI DSS audit requirements

PCI DSS v4.0 requirement 11 covers security testing. Internal vulnerability scans quarterly. External vulnerability scans quarterly by an Approved Scanning Vendor (ASV). Internal and external penetration testing at least annually and after any significant change. Application security testing for web applications. Requirement 12.10 covers incident response, which intersects with the pen test and audit world through formal reporting obligations. Requirement 12.10.2 specifically requires that the incident response plan be reviewed annually and tested at least annually.

A SOC 2 pen test can satisfy PCI requirement 11.4 only if the scope, methodology, and rigor match. The scope question is usually the limiter. A SOC 2 audit may not include the same cardholder data environment that PCI requires to be tested.

Audit committee evidence and the right-to-audit clause

Real audits are evidence-heavy. The audit committee or external examiner asks for specific artifacts: rules of engagement, final pen test reports, ticketed remediation logs, retest results, committee minutes that document the review, and attestations from system owners that critical findings were closed or formally accepted. A junior analyst who can pull those artifacts cleanly and write the cover memo is immediately useful.

The right-to-audit clause is a contract term that lets a customer audit a vendor. Master Service Agreements (MSAs) often include them. The clause does not automatically grant the customer the right to receive every artifact. Non-disclosure agreements (NDAs) gate the sharing. Attestations let the vendor summarize what the evidence shows without handing over raw findings. SP-5.3 (third-party risk) covers the contract side of this in more detail.

Quick-reference scenario map

Common gotchas

• Audit vs assessment. Audit measures against a defined standard. Assessment measures the program overall. The exam tests this directly.
• Self-assessment vs internal compliance audit. The internal audit has independence from operational management. A self-assessment is the team scoring itself. Different rigor, different evidence value.
• SOC 2 is not a regulatory audit. SOC 2 is a private examination, performed by an outside CPA firm, under the AICPA Trust Services Criteria. The regulator is not in the picture.
• White-grey-black box is legacy vocabulary. CompTIA-current names are known, partially known, and unknown environment. The exam tests the new phrasing.
• Passive recon is not the easy version of active recon. Good passive recon often defines the entire engagement. Treat it as a discipline, not a shortcut.
• Attestation is not the same as an audit. Attestation is a signed statement. An audit is an independent examination. SOC 2 Type II includes both, which is where the confusion enters.
• Independent third-party is a structural test. Ask whether the auditor is employed by, paid by, or otherwise dependent on the organization being audited. If yes, the work is not independent.
• PCI DSS pen testing has its own cadence. Internal scans quarterly, ASV external scans quarterly, pen tests annually plus after any significant change. SOC 2 testing does not automatically satisfy PCI requirement 11.

Real-world context

A SOC manager or vCIO at a mid-market firm sees the audit calendar drive a meaningful share of the quarter. The pattern: an internal compliance audit against ISO 27001 in Q1, a SOC 2 Type II evidence collection running continuously, a PCI ASV external scan due in March, June, September, December, an annual penetration test scheduled for Q3 with a signed rules-of-engagement document, and a board audit committee read of the annual security report in Q4. Each engagement has its own evidence requirements, its own reporting cadence, and its own remediation ticket queue.

Sample audit-day walkthrough. The external CPA firm arrives onsite for SOC 2 Type II fieldwork. The GRC analyst opens the evidence portal and walks the auditor through control AC-2 (account management). The evidence packet includes the access review attestation signed by the system owner in March, the quarterly access certification records showing zero exceptions, the ticketed remediation log for the two access anomalies caught in May, and the policy revision history. The auditor samples ten user accounts, confirms each one against the access review, and marks the control as Satisfied. That four-minute exchange is what every prior month of evidence work was for.

Sample pen test scoping. The annual penetration test against the production environment is partially known. The tester gets the network diagrams and a read-only Active Directory enumeration but no source code. The rules of engagement specify a two-week window, no destructive actions, no DoS against production, daily check-in with the SOC at 10:00 ET, and a final report delivered within ten business days. The tester runs passive recon for the first three days (WHOIS, public DNS, Shodan, LinkedIn for org chart, the Wayback Machine for prior site versions). Active scanning starts on day four against the scoped ranges. The SOC watches the EDR queue for the tester's traffic, confirms detection, and tunes any false negatives mid-engagement. The final report names two critical findings, four high findings, and one observation about logging gaps. Each finding becomes a ticket in the remediation queue.

Sources

• NIST SP 800-115 Technical Guide to Information Security Testing and Assessment
• NIST SP 800-53A Rev 5 Assessing Security and Privacy Controls in Information Systems and Organizations
• PCI DSS v4.0 requirements 11 and 12.10
• AICPA SOC 1 and SOC 2 Trust Services Criteria
• ISO/IEC 27001:2022 and ISO/IEC 27002:2022
• HIPAA Security Rule 45 CFR 164.308 and 164.312
• FFIEC IT Examination Handbook, Information Security booklet
• CompTIA Security+ SY0-701 Exam Objectives (V7.0)