Chapter7

Executive Summary

Provides a high-level overview of the audit's purpose, scope, methods, findings, and recommended actions. "Introduction, Objective and scope, Methodology, Findings, Recommendations, Action Plan."

Summary of Findings

Organizes audit results into criteria, circumstance, cause, and impact to clearly communicate issues discovered. "Criteria, Circumstance, Cause, Impact."

COBIT Maturity Model

Measures process performance and identifies improvement areas across IT functions using a graded scale from Level 0 to Level 5. "Maturity process is graded — Level 0 to Level 5 (process not in place to optimizing process)."

Security Assessment Results

Document the introduction, approach, system characterization, threat statement, assessment results, and summary of the security evaluation. "Introduction, Approach, System characterization, Threat statement, Assessment Results, Summary."

Resulting Risks

Represent the combined effect of impact and threat likelihood, forming the basis for prioritizing remediation. "Product of Impact and Threat Likelihood."

Reporting on IT Security Controls

Uses structured NIST forms to document system information, control details, findings, and assessor recommendations. "Section I: Information Systems and Assessment Information...Section IV: Assessor Comments and Recommendations."

Common IT Security Controls

Include policies, responsibilities, training, correct application processing, vulnerability management, continuity, and incident management. "Information security policies...Security incident management."

Gap Analysis Countermeasures

Address deficiencies by ensuring intellectual property protection, record protection, personal information protection, unauthorized use prevention, and cryptographic control management. "Respect IPR, Protect Records, Protect Personal Information, Prevent Unauthorized Use, Manage Cryptographic Controls."

Compliance Assessment Results

Categorize each control as compliant, noncompliant, not determined, or not applicable. "Compliant, Noncompliant, Not Determined, Not Applicable."

Presenting Compliance Recommendations

Outline actions to reduce weaknesses, close gaps with standards, and meet legal and regulatory requirements. "Recommended actions to lessen control weaknesses...Recommended actions to comply with applicable laws and regulations."

Compliance Recommendations (Qualities)

Must be tied to findings, actionable, cost-effective, strategic, and aligned with regulatory requirements. "Should be logically tied to a finding...Being compliant with regulatory requirements."

Management Action Plan

Assigns responsibilities, deadlines, and corrective guidance, and documents agreed-upon actions for follow-up audits. "Assigning responsibilities...Documented results and recommendations will be examined in the next audit."

GLBA (Gramm-Leach-Bliley Act)

Establishes administrative, technical, and physical requirements for protecting nonpublic personal information within financial institutions.

Financial Privacy Rule (GLBA)

Defines how financial institutions must handle consumer and customer information, including disclosure and privacy rights. "Financial Privacy Rule."

Safeguards Rule (GLBA)

Requires institutions to implement security measures to protect nonpublic personal information and prevent breaches such as identity theft. "Penalties would likely include equitable damages caused by the loss of privacy. For example, a breach of security resulting in an identity theft."

Pretexting Protection

Involves educating employees and consumers about social engineering tactics to prevent unauthorized access to personal information.

Nonpublic Personal Information (NPI)

Includes personal and financial data that GLBA requires institutions to protect through proper handling, storage, and security controls.

FTC Enforcement (GLBA)

The Federal Trade Commission enforces compliance and may bring administrative actions against institutions violating the Safeguards Rule. "The Federal Trade Commission (FTC) may bring an administrative enforcement action against any institution for noncompliance with the Safeguards Rule."