7.2. Security Control Testing Techniques

💡 First Principle: Audits verify conformance to defined requirements — they answer "does the actual state match the required state?" not "is the organization maximally secure?" Compliance is a floor, not a ceiling. A fully compliant organization may still have material security gaps not covered by the applicable standard — and a non-compliant organization may have excellent security in unmeasured areas.

Audits are governance mechanisms: they create evidence chains that management, regulators, and customers can rely on. Without audit evidence, security claims are assertions; with audit evidence, they are verifiable facts.

Why this matters: Audit independence requirements, the distinction between SOC 2 Type I and Type II, and which testing method is appropriate for which vulnerability class are all directly tested.

⚠️ Common Misconception: "Passing an audit means the organization is secure." Audits test against the scope of the applicable standard — nothing more. SOC 2 Type II certifies that specific trust service criteria controls operated effectively during the audit period. It says nothing about controls outside that scope or attack vectors not addressed by the standard's control set.