Direct answer
Start with what changed in the release, identify the affected trust boundaries and choose checks that cover both new behavior and existing controls. A focused release assessment supplements rather than replaces broader periodic testing.
Map the change
Record changed routes, roles, integrations, deployment configuration and dependencies. A new invoice export can introduce a data-access boundary even if the main invoice page is unchanged. Include the deployed version and environments in the assessment plan.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Select targeted controls
For the export example, check the same-owner download, cross-tenant denial and shared-access policy using known test records. If a background job generates the file, include both the request and the resulting download route. Agree on safe test data and request limits.
- Include related API and user-interface paths.
- Identify what changed in privilege or data flow.
- Track new third-party or background processing dependencies.
Compare previous evidence
Review relevant historical findings and regression tests. A prior pass may no longer apply when the implementation or configuration changed. Conversely, unchanged areas may remain outside this focused test; document that scope so the release is not presented as a whole-application assessment.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Record the outcome
State the release, checks, roles and fixtures used, along with unavailable or excluded paths. Assign an owner for follow-up and retest any confirmed fix in the deployed environment. Monitor for changes that invalidate the result.
Assessment limits
Release-focused checks can miss unrelated vulnerabilities or paths not represented by the change analysis. They do not guarantee the entire application is secure.
Frequently asked questions
Does a release test replace an annual assessment?
No. A focused change review and a broader assessment cover different scopes; choose both based on the system's risk and change rate.
What if the release changes during testing?
Record the deployment versions and decide with the owner which checks need to be repeated.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.