Structured examination of a system's security controls, configuration and practices against a standard or policy.