A process used to determine that the security features of a system are implemented as designed. This includes hands-on functional testing, penetration testing, and verification.