/test-control

description: Test security control effectiveness with automated validation

Test Control

Automatically tests whether security controls are properly implemented and effective. Validates configuration, functionality, and compliance with framework requirements.

Usage

/grc-engineer:test-control <control-id> [cloud-provider] [options]

Arguments

• `$1` - Control ID or name (e.g., "access_control_account_management", "AC-2", "encryption_at_rest")
• `$2` - Cloud provider (optional): `aws`, `azure`, `gcp`, `kubernetes` (default: auto-detect)
• `$3` - Options (optional): `--verbose`, `--fix-failures`, `--output=json`

Examples

# Test access control implementation
/grc-engineer:test-control access_control_account_management

# Test encryption on AWS with verbose output
/grc-engineer:test-control encryption_at_rest aws --verbose

# Test logging and auto-fix failures
/grc-engineer:test-control logging_and_monitoring --fix-failures

# Test all controls (summary)
/grc-engineer:test-control all aws

Test Categories

1. Configuration Tests

Validates that controls are properly configured:

• Resources exist and are enabled
• Configuration matches requirements
• Required parameters are set correctly

2. Functionality Tests

Verifies controls are actually working:

• Services are active and responding
• Data is being collected/protected
• Automation is functioning

3. Compliance Tests

Checks alignment with framework requirements:

• Meets all framework criteria
• No conflicts or gaps
• Evidence can be collected

4. Integration Tests

Ensures controls work together:

• Data flows correctly
• Dependencies are satisfied
• No configuration conflicts

Output Format

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CONTROL TEST RESULTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Control: Access Control - Account Management (AC-2)
Frameworks: NIST 800-53, ISO A.9.2, SOC2 CC6.1, PCI 8.1
Cloud Provider: AWS
Test Duration: 12.3s

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CONFIGURATION TESTS (5)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ TEST 1: Unique User IDs
  Status: PASS
  Requirement: All users must have unique identifiers
  Result: 47 IAM users found, all with unique IDs
  Frameworks: All

✓ TEST 2: Access Approval Process
  Status: PASS
  Requirement: Documented approval for all user accounts
  Result: 100% of users have creator tags with approval timestamps
  Evidence: All users tagged with Creator and ApprovedBy
  Frameworks: NIST AC-2, SOC2 CC6.1

✗ TEST 3: Quarterly Access Reviews
  Status: FAIL
  Requirement: Access reviews every 90 days (PCI 8.1.4)
  Result: Last review: 2024-11-15 (92 days ago)
  Expected: Reviews within last 90 days
  Impact: PCI-DSS violation
  Frameworks: PCI-DSS 8.1.4

  Remediation:
  Run quarterly access review immediately:
  ```bash
  aws lambda invoke \
    --function-name quarterly-access-review \
    --payload '{"trigger":"manual"}' \
    response.json

Or use automated script:

  python scripts/access_review.py --immediate

✓ TEST 4: Automated User Provisioning Status: PASS Requirement: Automated account lifecycle management Result: IAM Identity Center configured with SCIM provisioning Frameworks: NIST AC-2(1), SOC2 CC6.2

✓ TEST 5: Least Privilege Enforcement Status: PASS Requirement: Permissions boundaries applied Result: 95% of users have permissions boundaries Note: 2 admin users exempted (documented) Frameworks: NIST AC-6, SOC2 CC6.1

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ FUNCTIONALITY TESTS (5) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ TEST 6: CloudTrail Logging Active Status: PASS Requirement: All account management events logged Result: CloudTrail active in all regions Events logged: 1,247 IAM events in last 24 hours Frameworks: NIST AU-2, SOC2 CC7.2

⚠ TEST 7: Inactive Account Detection Status: WARNING Requirement: Detect and disable accounts inactive >90 days Result: 3 users inactive >90 days detected

Inactive users:

• john.doe@company.com (127 days inactive)
• jane.smith@company.com (94 days inactive)
• test.user@company.com (215 days inactive)

Action required: Disable or justify retention Frameworks: PCI-DSS 8.1.4

Remediation:

  # Disable inactive users
  python scripts/disable_inactive_users.py --threshold=90 --execute

  # Or review individually
  aws iam list-users | jq '.Users[] | select(.PasswordLastUsed < "2024-09-15")'

✓ TEST 8: Access Analyzer Enabled Status: PASS Requirement: Continuous unused access detection Result: Access Analyzer active, 0 high-priority findings Last scan: 2 hours ago Frameworks: SOC2 CC6.1, NIST AC-2(4)

✓ TEST 9: MFA Enforcement Status: PASS Requirement: Multi-factor authentication required Result:

• Root account: MFA enabled
• IAM users: 45/47 have MFA (96%)
• 2 service accounts exempted (no console access)

Frameworks: NIST IA-2(1), PCI 8.3, SOC2 CC6.1

✓ TEST 10: Audit Trail Integrity Status: PASS Requirement: Tamper-proof audit logs Result: CloudTrail log file validation enabled S3 bucket: Object Lock enabled (COMPLIANCE mode) Frameworks: NIST AU-9, SOC2 CC7.3

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ COMPLIANCE TESTS (4) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ TEST 11: Log Retention Period Status: PASS Requirement: 1 year retention (PCI 10.7, SOC2) Result: S3 lifecycle configured for 365 days

• Online storage: 180 days
• Glacier archive: 185 days
• Total: 365 days ✓

Frameworks: PCI-DSS 10.7, SOC2 CC7.3, NIST AU-11

✓ TEST 12: Separation of Duties Status: PASS Requirement: Admin privileges separated Result: No users have both admin and auditor roles Frameworks: NIST AC-5, SOC2 CC6.1

✓ TEST 13: Evidence Availability Status: PASS Requirement: Evidence can be collected on demand Result: Evidence collection script executed successfully Arti