What is Verification?

Understanding Verification

Verification is the confirmation, through examination and objective evidence, that a product, process, or system meets its specified requirements. In security it confirms that controls are implemented correctly and operate as intended. The classic contrast: verification asks "did we build the thing right?" while validation asks "did we build the right thing?"

Verification works by comparing an implementation against a documented specification or baseline using repeatable methods. Assessors examine configurations, interview personnel, and test mechanisms to gather objective evidence. NIST SP 800-53A defines three assessment methods - examine, interview, and test - that produce findings on whether each control is satisfied. Outputs are concrete: configuration scans, test results, inspection records, and traceability matrices linking each requirement to evidence.

Verification matters because a control that exists on paper but is misconfigured offers no real protection. Without verification, organizations assume security they do not have - encryption that was never enabled, password policies never enforced, patches never applied. It underpins authorization decisions, audits, and compliance: ISO/IEC 27001, the NIST CSF, and assessment frameworks all depend on verified evidence rather than assertions. Skipping it lets latent misconfigurations reach production where they become breaches.

For example, before a government system enters production, an assessment team verifies its security controls. They examine system configurations to confirm hardening standards are applied, test that authentication enforces the defined password policy and lockout thresholds, run vulnerability scans against the hardening baseline, and inspect documentation to confirm security features match requirements. Any gap - say, password complexity not actually enforced - is recorded as a finding and must be remediated before the system is authorized to operate.