Control Efficacy Validation: Defining a Missing Layer in Enterprise Assurance, Part 1 — The Assurance Gap

Enterprise cybersecurity assurance has traditionally relied on three primary sources of evidence: vulnerability assessments to identify known weaknesses, penetration testing to demonstrate exploitability, and red team exercises to evaluate an organization’s ability to detect and respond to realistic adversaries. Each remains an essential component of a mature security program.

None, however, was designed to answer a deceptively simple question: How do we know that the security controls we have deployed actually perform as intended against the threats they were designed to stop?

As regulatory expectations evolve from demonstrating the existence of controls toward proving their effectiveness, this question is becoming more important. Boards, auditors, regulators, and executive management are seeking objective evidence that the defensive technologies which were deployed continue to provide meaningful protection even after multiple software updates, policy changes, infrastructure modifications, and an ever-changing threat landscape.

NSS Labs believes that an additional distinct but complementary discipline—Control Efficacy Validation (CEV)—is required to address that requirement.