ASR-02Assurance and Evidence
Populations are complete
Where a control is tested by sample, the population is defined and its completeness can be demonstrated.
Why it exists
A sample from an incomplete population proves nothing.
What usually proves it
Population definitions, extraction method, completeness argument.
Smaller organizations
Small populations tested whole.
Mapped to
- Partially addressedSOC 2 Trust Services Criteria · CC4.1 — Evaluation is required; population completeness is an audit expectation rather than a criterion.
- Partially addressedISO/IEC 27001 Annex A · 9.2 — Audit programme requirements.
- Deliberately absentNIST Cybersecurity Framework — The Framework describes outcomes, not testing method.
- Fully addressedPCI DSS · Testing procedures
- Deliberately absentHIPAA Security Rule — No testing methodology defined.
- Deliberately absentGDPR — No testing methodology defined.
- Deliberately absentEU AI Act — Not addressed.
- Deliberately absentNIST AI Risk Management Framework — Not addressed.