On-site assessment involves:

• A. Conducting only interviews
• B. Conducting a physical assessment of risk controls and testing whether controls are as represented and how well they execute them
• C. Only reviewing vendor-provided policies
• D. Relying on third-party certifications without verification

Answer: (B)

On-site assessment is about validating that a vendor’s controls are actually in place and functioning, not just described in documents. It involves going to the site, examining both physical and technical controls, and performing tests to verify that they operate as claimed. This means observing processes, inspecting configurations, reviewing evidence such as logs and access records, and conducting targeted tests to confirm operating effectiveness under real conditions. The aim is to confirm that controls are designed appropriately, implemented correctly, and perform as represented during normal operation and in potential adverse scenarios.

Interviews alone can’t prove that controls are truly working, and reviewing policies or screenshots without testing won’t establish real-world effectiveness. Relying solely on third-party certifications without verification can be risky because certifications may be outdated, limited in scope, or not reflective of the specific environment being assessed.