Which statement best describes design testing versus operating effectiveness in security controls?

• A. Design testing verifies existence and specification of a control; operating effectiveness tests actual performance
• B. Operating effectiveness verifies documentation; design testing tests performance
• C. Both are only performed at project start
• D. Neither is relevant to security controls

Answer: (A)