Assurance in the context of security goes beyond just compliance or auditing. It’s about the level of confidence that security controls and measures are effectively protecting information systems as intended. Here’s a bit more on how to think about it:

• Degree of Confidence: Assurance is the measure of confidence that security controls are effective and functioning as intended. It involves evaluating whether security requirements are met through various means like testing, reviews, and assessments.
• Beyond Compliance: While audits are one way to achieve assurance, it also encompasses proactive measures such as continuous monitoring, threat modeling, and vulnerability assessments. Assurance is about ensuring that security measures not only meet regulatory requirements but also effectively manage risks and protect assets.
• Holistic Approach: Assurance should consider the entire security posture of an organization, including governance, risk management, and operational security. It’s about ensuring that all aspects of security are addressed and that the security framework is robust and resilient.

So, assurance is a comprehensive concept that includes not just compliance but also the effectiveness and reliability of security practices in managing and mitigating risks.