Does It Prove It? — TechKnowSurge

About this interactive

Attestation means evidence or proof. In an audit, it is the proof that the company is really doing what it set out to do. The lesson's example: an external auditor asks for a list of everyone who left last month, picks one, two or more names from it, and asks for proof that each person's account was shut off, and when. The company then shows, from its own systems, that the account was decommissioned, de-provisioned or disabled. That record is the proof that the company follows its policy. What counts is a record that shows the account's state and the date it changed: a log entry, the system's change history, a dated export or screenshot, an audit trail. What does not count is anything that says what should happen or what someone believes happened: the policy itself, the written procedure, a plan to check later, an open request, someone's assurance, or the list of leavers on its own. Security+ lists attestation among the types and purposes of audits and assessments.

What you'll learn

Recognize attestation as evidence that a policy is being followed: records that show what was done and when, not statements of what should happen
Tell what an auditor can accept as proof that a leaver's account was shut off, and when, from policies, plans, lists and assurances that prove nothing

Aligned to

CompTIA Security+

5.5 Explain types and purposes of audits and assessments.

NIST 800-53

CA-2 Control Assessments

Key terms

Attestation: The process of providing evidence or formal certification that a set of standards is being followed, either through self-reported documentation or third-party verification.
Audit: A formal and systematic examination of an organization's systems, policies, and procedures to verify that security controls are in place, functioning as intended, and meeting applicable compliance requirements.
External Audit: An independent assessment performed by a third party to evaluate an organization's cybersecurity posture and regulatory compliance.

Topics

Attestation Audit Compliance Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →