5.5 — Audits and Assessments

Internal audit

Audit performed by or for the organization to evaluate internal controls, compliance, or processes.

Compliance audit

Audit that checks whether activities and controls meet specified laws, regulations, policies, or standards.

Audit committee

Governance group that oversees audit activities, financial reporting, and related control matters.

Self-assessment

Organization's own evaluation of its security, controls, or compliance posture.

External audit

Audit performed by an independent outside organization.

Regulatory audit

Audit or examination performed by or on behalf of a regulatory authority.

Examination

Formal review or inspection used to determine compliance, condition, or effectiveness.

Independent third-party audit

Audit performed by an external party with sufficient independence from the organization being audited.

Physical penetration testing

Authorized testing that attempts to bypass or defeat physical security controls.

Offensive penetration testing

Authorized security testing focused on actively attempting to exploit weaknesses.

Defensive penetration testing

Testing focused on evaluating the effectiveness of defensive controls against simulated attacks.

Integrated penetration testing

Testing that combines multiple attack paths or domains, such as physical, network, and application testing.

Known environment

Penetration test in which the tester has substantial information about the target environment.

Partially known environment

Penetration test in which the tester receives limited information about the target.

Unknown environment

Penetration test in which the tester receives little or no information about the target beforehand.

Reconnaissance

Information gathering performed before or during a penetration test.

Passive reconnaissance

Collecting information without directly interacting with the target systems.

Active reconnaissance

Collecting information by directly interacting with the target systems or network.

Audit

Formal examination of systems, processes, controls, or records against defined requirements.

Assessment

Evaluation used to determine the effectiveness, condition, risk, or compliance of a system or control.

External assessment

Evaluation performed by an outside party to assess security controls, processes, or risks.