Testing officials should use which NIST publication as guide for developing test procedures? Response:

NIST SP 800-53A, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations," is the definitive NIST guide for developing test procedures and assessing security controls. It outlines the specific assessment methods, including examine, interview, and test, for each control and control enhancement.

NIST SP 800-37A does not exist. NIST SP 800-37 is the "Guide for Applying the Risk Management Framework," which is a process, not a guide for developing test procedures.

NIST SP 800-39, "Managing Information Security Risk," provides an organizational-level approach to risk management, not detailed guidance for developing technical test procedures.

NIST SP 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations," defines the security controls themselves, but not the procedures for testing them; that is the purpose of 800-53A.