What it covers. NIST guidance on planning and conducting technical security testing and assessments, analysing findings and developing mitigation strategies. It covers review techniques, target identification and analysis, vulnerability validation such as penetration testing, and the planning and reporting around them.
In practice. Applying it well means having an assessment policy, defining scope and rules of engagement in writing, and choosing techniques that match the objective, from configuration review to penetration testing. Testers handle data from the assessment securely, and findings are prioritised and tracked to remediation. Evidence includes approved test plans, reports and remediation records.
Common gaps. Typical gaps are tests with unclear scope or authorisation, findings that are not tracked to closure and repeated testing of the same assets while others are never assessed. The publication dates from 2008, so tooling examples are dated.