5.5 Audits and Assessments

Cybersecurity Audit

Allows us to examine many aspects of our computing environment.

• For example, we can examine the IT infrastructure, the software that we’re using, and all of the devices that are used to communicate over our network.

• We might also want to look through our existing policies and procedures and make sure that we are properly protected against today’s modern threats.

• Can also sometimes find vulnerabilities in our network before the hackers find them, effectively making us much safer.

• Always be something that we could perform internally, but we might even want to bring in a third party for a thorough overview

Attestation

An opinion of truth that is associated with the results of an audit.

• We’ll commonly perform an audit, and then we will attest to the results of that audit.

Internal Audits

Review their own compliance without needing a third party.

• Help confirm that all compliance tasks are being properly followed

• Often begin with a self-assessment, where teams evaluate their processes and compare them to compliance requirements.

Audit committee

A group that is responsible for all of the risk management associated with an organization.

• Both starting and stopping any internal audits

• Can then compile all of these self-assessments together to get an idea of where the organization might be as it relates to compliance.

External Audits

Required by some compliance regulations and must be performed by a third party.

• Type and frequency of these audits are determined by the specific regulation

• Auditors visit the organization, review records, and gather detailed information

• Then compile their findings to show the current state of compliance and highlight areas where the company can improve