ASR-04Assurance and Evidence
Independent testing and reporting
Controls are tested by someone other than the person who performs them, and results are reported without softening.
Why it exists
Self-assessment that never finds anything is a marketing document.
What usually proves it
Test plans, results, findings and management responses.
Smaller organizations
A peer, an adviser or a rotating reviewer.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC4.1
- Fully addressedISO/IEC 27001 Annex A · 9.2
- Fully addressedNIST Cybersecurity Framework · GV.OV-01
- Fully addressedPCI DSS · 12.11
- Fully addressedHIPAA Security Rule · 164.308(a)(8)
- Partially addressedGDPR · Art. 32(1)(d) — Regular testing and evaluation.
- Partially addressedEU AI Act · Art. 17 — Quality management system includes verification.
- Fully addressedNIST AI Risk Management Framework · MEASURE 4.1