We provide ST&E support, which includes, but is not limited to formally testing the system's controls (depending on the scope of the certification review as determined by the sensitivity, size, and nature. e.g. general support systems and major applications) to determine whether when turned on, the controls actually work and provide the intended protection. We prepare extensive test plans for the security test and evaluation (ST&E) of systems by looking at certain areas in depth, such as: management procedures and controls, physical, data, operating system, application software, personnel, network security, and disaster recovery.