ASR-04 · Assurance and Evidence
Independent testing and reporting
Controls are tested by someone other than the person who performs them, and results are reported without softening.
6frameworks fully address it
2partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC4.1
- ISO 27001Full9.2
- NIST CSFFullGV.OV-01
- PCI DSSFull12.11
- HIPAAFull164.308(a)(8)
- GDPRPartialArt. 32(1)(d) Regular testing and evaluation.
- EU AI ActPartialArt. 17 Quality management system includes verification.
- NIST AI RMFFullMEASURE 4.1
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Test plans, results, findings and management responses.
?Why it exists
Self-assessment that never finds anything is a marketing document.
For a smaller organizationA peer, an adviser or a rotating reviewer.