TL;DR

• A cybersecurity audit checklist is a concise, action-oriented roadmap that teams use to validate technical controls, policies, and processes across people, systems, and vendors. It lists the checks auditors perform so you can prove compliance and reduce the attack surface quickly.
• An audit verifies controls and evidence against standards and regulations; an assessment (like a vulnerability or penetration test) finds technical weaknesses; and compliance confirms you meet legal or regulatory obligations.
• The checklist turns ad hoc work into repeatable actions, ranks remediation by business risk, and feeds continuous improvement. Map it to a recognised framework (ISO 27001, NIST CSF 2.0, CIS Controls or SOC 2) so one set of evidence serves several audits.
• Most organisations should audit at least once a year, and more often in regulated sectors or after major changes such as a cloud migration, an acquisition or a new regulation like NIS2 or DORA.

What Is a Security Audit Checklist?

A security audit checklist is a structured list of the controls, documents and evidence an auditor examines to confirm that an organisation protects its information systems as intended. Each line names a control (for example, multi-factor authentication on administrator accounts), the evidence that proves it works (an access report), and the standard or regulation it satisfies. It differs from a generic IT checklist in one way: every item is tied to a risk or an obligation, so the result can be defended to a regulator, a customer or a board.

Checklists exist at several levels of detail. A cyber security audit checklist for a board summarises ten to fifteen control domains. An operational version, like the one in this article, runs to dozens of checks grouped by domain. A framework-specific version reproduces the control set of ISO 27001, the CIS Controls or SOC 2 and maps your evidence to each control number. A domain-specific version, such as a network security audit checklist, narrows the same method to firewalls, segmentation, scanning and patching.

Why Is a Security Audit Checklist Important?

A security audit checklist is important because it converts a vague objective ("be secure") into a finite set of verifiable questions. That has four practical benefits: it makes audits repeatable from one year to the next, it exposes gaps before an attacker or a regulator does, it produces the evidence pack that GDPR (Article 32), NIS2 and DORA all require, and it gives leadership a risk-ranked view of what to fund. Without one, audits depend on whoever happens to run them and results cannot be compared over time.

The compliance stakes are concrete. Under the GDPR, a security failure that leads to a personal data breach can be fined at up to 4% of global annual turnover or 20 million euros, whichever is higher (Article 83(5)). DORA has applied to EU financial entities since 17 January 2025, and NIS2 obliges essential and important entities to demonstrate risk-management measures to national authorities. A structured checklist is the fastest way to show that those measures exist and operate.

Pre-Audit Preparation

Before diving into technical checks, spend time preparing. Good pre-audit prep saves time and focus later. This phase involves defining the scope, gathering documentation, and assembling the audit team.

Define scope and objectives

First, decide exactly what will be audited and why. Determine which systems, networks, data, and applications fall within scope. For example: production servers, cloud environments, IoT devices, and customer databases. Identify any compliance or regulatory frameworks that apply. Common examples include GDPR (EU personal data), PDPA (Singapore), HIPAA (US healthcare), PCI-DSS (payment data), and industry security standards such as ISO 27001. Clearly document the objectives (e.g., "demonstrate GDPR compliance for customer data") and criteria.

Gather documentation and policies

Next, collect all relevant information and evidence so the auditors understand the environment. Key documents and records include:

• Security policies and procedures: e.g., Information System Security Policy (ISSP), access control policy, acceptable use, incident response, remote work, password policies. (These often form your baseline cyber security policy framework.)
• Risk registers and past audits: any cybersecurity risk assessments, previous audit reports, or compliance gap analyses.
• Network and system documentation: current network diagrams, asset inventories, data flow maps, and architecture diagrams.
• Baseline configurations: approved configurations for servers, routers, firewalls, and endpoints.
• Change logs: records of recent major changes, software updates, and patches applied.
• Privacy documentation: the record of processing activities, retention schedule and any completed privacy audits. Our downloadable Data Privacy Audit Checklist covers this side so the two audits share evidence.

DPO Consulting's process explicitly includes collecting "current security policies and procedures" and details about hardware/software and third-party providers. Having these documents ready means auditors can immediately verify controls rather than hunt for evidence later.

Assemble the audit team and stakeholders

Finally, form the audit team and involve key stakeholders. Identify who will lead the audit (often a CISO, security manager, or external consultant) and who else will participate. Typical roles include:

• Audit lead: plans and drives the audit process.
• IT/Security engineers: provide system access, logs, and technical evidence.
• Process owners: people responsible for areas being audited (e.g., HR for employee training, finance for payment systems).
• Legal/Compliance officers: ensure regulatory requirements are addressed.

Cybersecurity Audit Frameworks & Standards

Four frameworks shape most audit checklists: ISO/IEC 27001, the NIST Cybersecurity Framework, the CIS Critical Security Controls and SOC 2. They overlap heavily, so the efficient approach is to pick one as the spine of your checklist and map the others to it. The table below shows what each one is for and who typically asks for it.

Source: ISO, NIST, Center for Internet Security and AICPA publications listed in the references, checked 18 September 2026.

ISO 27001

ISO/IEC 27001 is the international standard for an information security management system and the only one of the four that leads to a certificate. The 2022 revision reorganised Annex A into 93 controls across four themes (organisational, people, physical and technological). An ISO 27001 audit checklist therefore has two halves: the management-system clauses 4 to 10 (context, leadership, risk assessment, performance evaluation) and the Statement of Applicability that justifies which Annex A controls you apply. Auditors read the Statement of Applicability first, so keep it current. Our guide to ISO 27001 certification cost explains what the certification cycle involves.

NIST Cybersecurity Framework

The NIST Cybersecurity Framework 2.0, published by the US National Institute of Standards and Technology in February 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe controls, which is why it works well as the reporting structure of an audit checklist: each finding can be tagged to a function and category, and the result reads clearly to a board. The Govern function, new in 2.0, covers strategy, roles, policy and supply-chain risk, and maps directly to the policy and vendor sections of this checklist.

CIS Controls

The CIS Critical Security Controls are the most prescriptive of the four. Version 8.1, released by the Center for Internet Security in June 2024, lists 18 controls broken into 153 safeguards and groups them into three Implementation Groups. IG1 is the minimum set of 56 safeguards for small organisations, IG2 adds safeguards for organisations with dedicated security staff, and IG3 covers the full list. If you are building a cyber security assessment checklist from scratch, IG1 is a defensible starting point, and CIS publishes mappings to NIST CSF 2.0 and ISO 27001:2022 so the work carries over.

SOC 2

SOC 2 is not a standard you certify against but an attestation report issued by a licensed CPA firm under the AICPA's Trust Services Criteria (2017 criteria, points of focus revised in 2022). The Security category is mandatory; Availability, Processing Integrity, Confidentiality and Privacy are added according to what you promise customers. A Type I report covers control design at a point in time; a Type II report covers operating effectiveness over a period, usually six to twelve months. If your customers are SaaS buyers in North America, your checklist should carry SOC 2 criteria references so evidence collected for internal audits can be reused for the attestation.

For EU organisations, two regulations sit on top of these frameworks: NIS2 for essential and important entities and DORA for the financial sector. Neither prescribes a control catalogue, so both are usually audited through ISO 27001 or NIST CSF. Our article on ISO 27001, NIS2 and DORA explains how to run one programme that satisfies all three.

Core Checklist Areas

A thorough cybersecurity audit checklist spans multiple domains. Below are the key areas and example controls to verify. Together, they form a comprehensive cyber security controls checklist that covers all layers of your defences. Auditors will systematically check each of these areas.

Access controls and identity management

• Role-based access: Verify that users have only the permissions needed for their role (principle of least privilege). Review user groups and roles, and ensure separation of duties where appropriate.
• Multi-factor authentication (MFA): Check that MFA is enabled for critical accounts (e.g., all administrator accounts, remote access/VPN, cloud management consoles).
• Account provisioning/deprovisioning: Ensure there is a process for creating and removing accounts. Test recent-hire and offboarding lists to confirm that old accounts were disabled promptly.
• Regular access reviews: Confirm that managers periodically review user permissions. Look for documentation of an access review (e.g., quarterly access recertification).

Make sure password policies (complexity, rotation) and session controls (session timeouts, login lockouts) meet the IT security best practices checklist. A gap in any of these controls (e.g., inactive accounts, missing MFA) should be flagged by the audit checklist.

Network and infrastructure security

• Firewalls and IDS/IPS: Make sure the firewalls are installed at network boundaries and properly configured (with documented rules and unnecessary ports closed). Check that Intrusion Detection/Prevention Systems are active and up to date with the latest signatures.
• Network segmentation: Verify that critical systems (e.g., payment servers, medical devices) are segregated on separate subnets or VLANs. Ensure there are internal firewalls or ACLs limiting lateral movement.
• Vulnerability scanning: Check that regular vulnerability scans (automated scans of servers, workstations, network devices) are scheduled and results are reviewed. Review the latest scan report to see if high-severity flaws were identified and addressed.
• Patch management: Ensure a documented patch management process is in place. Verify operating systems, applications, and network devices have current security patches. Look for patch logs or tools' dashboards showing recent patch activity.

The audit verifies both perimeter defences and internal protections. For example, evidence may include firewall configuration exports, IDS alert logs, network segmentation diagrams, and vulnerability scan reports with remediation notes. These four items are the core of any network security audit checklist; a network security assessment checklist adds active testing such as authenticated scans and firewall rule reviews against a documented baseline.

Data protection and encryption

• Encryption: Check that sensitive data is encrypted in transit (e.g., TLS on web servers, secure file transfer) and at rest (e.g., disk encryption on laptops, database encryption). Verify encryption standards (AES-256, TLS 1.2+).
• Data classification and handling: Review how data is classified (public, internal, confidential) and ensure controls match classification (e.g., confidential data restricted to business PCs, not personal devices).
• Backup and recovery: Verify that critical data is backed up regularly. Check backup encryption and storage (off-site or cloud). Importantly, look for evidence that backups are tested: audit notes or logs from a recent backup recovery drill demonstrate you can restore data.
• Data erasure: Ensure procedures exist for securely wiping data when decommissioning devices or media.

Endpoint and device security

• Anti-malware/EDR: Confirm that anti-virus/anti-malware software or an Endpoint Detection and Response (EDR) solution is installed and up-to-date on servers, desktops, and laptops. Check the latest scan results or alerts.
• Patching and hardening: Review that endpoints have current OS and software patches. Check baseline hardening standards (disabled ports, removed default accounts). Auditors may select a few random machines to verify configurations against the baseline.
• Mobile Device Management (MDM) and BYOD: If employees use mobile devices, ensure they are managed. Check MDM policies (encryption on devices, remote wipe capability). For BYOD, review any acceptable-use or containerisation controls (e.g., separate work profiles).
• USB and peripheral controls: Verify policies or technical blocks on USB drives if applicable, to prevent easy data theft or malware introduction.

Incident response and logging

• Logging and monitoring: Confirm that logging is enabled for critical systems (firewalls, servers, applications). Check if a Security Information and Event Management (SIEM) or log aggregator is in use. Ensure logs are retained for a sufficient period and protected from tampering.
• Alerting: Verify that alerts are configured for key events (multiple failed logins, large data transfers, malware detection). Review recent alerts and how they were handled.
• Incident response plan: Confirm that a documented cybersecurity incident response plan exists and defines roles and procedures. The plan should cover detection, containment, eradication, and recovery. Look for evidence that it is tested (e.g., notes from a tabletop exercise).
• Playbooks: Check if there are specific playbooks for common incidents (ransomware, data breach, DDoS). Confirm communications plans (who to notify internally and externally, including regulators if needed).

Vendor and third-party risk

• Vendor assessments: Critical third-party vendors (cloud providers, SaaS apps, managed services) should undergo third-party risk assessments. This might be via questionnaires, audits, or reviewing third-party audit reports (SOC 2, ISO 27001 certificates). Check that these assessments are up-to-date.
• Contractual safeguards: Verify contracts require vendors to meet certain security standards, notify you of breaches, and allow audit rights. Look for clauses on data protection, liability, and incident notification.
• Access reviews: Ensure any access given to vendors (network VPN, admin accounts) is documented and reviewed. Vendor access should follow the principle of least privilege and must be promptly revoked when no longer needed.
• Inventory and monitoring: Maintain a registry of all third parties handling sensitive data. The audit may include reviewing this inventory and verifying that vendors' security controls are adequate.

Third parties often handle sensitive information, so "without proper oversight, this data can be exposed to unauthorised access or breaches". The cyber security assessment checklist flags missing vendor reviews or weak contract terms as gaps.

Policy and training review

• Policy coverage: Check that all relevant security policies exist and are up-to-date. This includes policies on data privacy, acceptable use, password standards, remote work, and BYOD. Verify that policies reflect current best practices and regulatory requirements.
• Training programs: Confirm that employees receive regular security awareness training (e.g., phishing simulation results, attendance records). There should be evidence of training on topics like phishing, data handling, and incident reporting.
• Policy acknowledgment: Ensure there is a mechanism for employees to acknowledge policies (e.g., signed AUP, completion of training).
• Enforcement: Check that violations are addressed (e.g., disciplinary records if policy breaches occurred). The audit may review how policy compliance is monitored.

Security culture is crucial. Auditors often interview staff to confirm understanding of policies. Any gaps (e.g., outdated policy or lack of training logs) are noted.

Physical and environmental security

• Facilities access: Verify that server rooms, data centres, and critical areas have strong physical controls (badge readers, locks, biometric scanners). Check visitor logs and keycard access records.
• Surveillance: Ensure cameras and alarms cover sensitive locations. Review footage logs or access records if available.
• Hardware protection: Confirm that hardware (servers, networking gear) is secured in racks/cages. Check for cable locks or secure enclosures on laptops and portable devices.
• Environmental controls: Verify fire suppression, climate control, and UPS/backups in data centres. Check maintenance logs (fire extinguisher inspections, generator tests).

No matter how strong digital controls are, physical breaches can subvert them. The audit notes any weaknesses, like unlocked racks or expired alarms.

Risk Assessment & Gap Analysis

After covering core areas, the audit transitions into a risk and gap analysis. This involves identifying residual vulnerabilities, evaluating control effectiveness, and prioritising fixes. If you want to benchmark the result against a maturity scale rather than a pass/fail list, pair the audit with a Cybersecurity Maturity Assessment.

Identify vulnerabilities and threats

Perform both manual and automated testing to uncover weaknesses. Run vulnerability scans, configuration reviews, and (if possible) penetration tests on systems and networks. Interview staff and review logs to identify procedural gaps. For the network layer, a network security assessment checklist (authenticated scans, firewall rule review, wireless and remote-access tests) gives this step a repeatable structure. Based on that, auditors map each vulnerability to potential threats (malware, phishing, insider threats, etc. and misconfiguration) and associated impacts (data loss, service disruption). For example, if a critical server is unpatched, the team rates the risk (e.g., high) given that threat.

Control evaluation and effectiveness

For every control on the information security checklist, verify that it's not just documented but actually implemented and working. If a firewall rule is supposed to block certain traffic, the auditor may test it or check logs to confirm it's active. Gather evidence for each control: system configuration snapshots, scan results, or logs.

Prioritise remediation

Once vulnerabilities and control gaps are identified, rank them by risk severity and business impact. Use a simple scale (critical, high, medium, low) based on likelihood and consequence. Involve business leaders to ensure priorities align with risk appetite. Document a remediation plan: assign each issue to an owner, set deadlines for fixes, and define how fixes will be verified. Focus first on critical fixes that protect sensitive assets or compliance obligations (for example, applying a patch for a known exploit). Medium/low issues can follow. The goal is a clear roadmap so the organisation knows what to fix, who will fix it, and by when.

Reporting & Remediation

The final audit outputs are the report and remediation plan. Both stand or fall on clear communication: a finding nobody understands does not get fixed.

Audit report structure

The audit report should be structured and easy to understand. Typical sections include:

• Executive summary: High-level overview of scope, objectives, and overall security posture.
• Findings: Detailed list of issues, organized by category (e.g., access control, network). Each finding should describe the issue, evidence, risk level, and relevant reference (policy or standard).
• Risk and impact: For each finding, note the potential impact (data breach, compliance fine, service outage) and risk rating.
• Recommendations: Actionable steps to fix each issue (for example, "enable MFA on all remote logins" or "update antivirus software").
• Appendices: Supporting details like test results, scanned logs, or a list of interviewed personnel.

Tables or charts (such as a heat map of vulnerabilities) can help executives grasp the most critical issues at a glance. A well-organized report ensures stakeholders see the risks and can make informed decisions.

Remediation roadmap and tracking

Alongside the report, provide a remediation roadmap. This is often a table or ticket list showing each issue with the owner, action steps, and target completion date. Use a project management tool or spreadsheet to track progress. Regularly review this plan in meetings. Mark issues closed only when fixes are verified (see next section). Effective tracking prevents issues from falling through the cracks. Communicate progress and any resource needs (e.g., extra IT support) to leadership.

Follow-up audits and validation

An audit doesn't end after fixes are assigned. Plan follow-up reviews to validate remediation. This may involve retesting fixes (e.g., re-running scans, re-checking configurations). Confirm that evidence is produced (screenshots, logs) showing that issues are resolved. Document the closure of each finding. Update the cybersecurity audit checklist with any improvements implemented (for example, if new controls were added or policies changed). Finally, schedule the next audit (often annually). Cybersecurity is dynamic, so ongoing validation of controls is essential.

Information Security Assessment Checklist

An information security assessment checklist covers the governance and resilience layer that sits above the technical controls listed earlier. Where the core checklist asks "is the firewall configured", this layer asks "who decided the firewall policy, do we know every asset it protects, would we notice if it failed, and could the business keep running if it did". The four areas below complete the picture and correspond to the Govern, Identify, Detect and Recover functions of NIST CSF 2.0.

Security policies and governance

• Ownership: A named executive is accountable for information security, and the board or an equivalent body reviews security risk at least annually.
• Policy hierarchy: A top-level security policy is approved by management, supported by topic policies (access, acceptable use, cryptography, supplier security) with a review date on each.
• Risk management: A documented methodology, a risk register that is updated after incidents and major changes, and a defined risk appetite.
• Compliance mapping: Each applicable obligation (GDPR, NIS2, DORA, PCI-DSS, sector rules) is mapped to the controls that satisfy it, so evidence can be produced on request.

Weak governance is the finding that most often undermines otherwise good technical controls. Our guide to what cybersecurity governance is sets out the structure regulators expect to see.

Asset management

• Hardware and software inventory: A complete, current inventory of devices, servers, cloud instances and software, with an owner for each. CIS Controls 1 and 2 place this first for a reason: you cannot protect what you have not listed.
• Data inventory: Where sensitive and personal data lives, who can reach it and how long it is kept, aligned with the GDPR record of processing activities.
• Shadow IT and shadow AI: A process to detect unsanctioned SaaS tools and generative AI use, since both create unmanaged copies of company data.
• Lifecycle: Documented procedures for onboarding, patching, decommissioning and secure disposal of assets.

Security monitoring and detection

• Coverage: Logs from identity providers, endpoints, network devices, cloud platforms and critical applications reach a central SIEM or equivalent.
• Detection rules: Alerts exist for the scenarios in your incident playbooks (ransomware precursors, privilege escalation, mass data export) and are tuned to keep false positives manageable.
• Response times: Measured mean time to detect and mean time to respond, with targets that reflect regulatory notification deadlines (72 hours under GDPR Article 33; an early warning within 24 hours under NIS2 Article 23).
• Threat intelligence: A defined source of vulnerability and threat information and a process for acting on it.

Business continuity and disaster recovery

• Business impact analysis: Critical processes and systems are identified with recovery time and recovery point objectives agreed by the business.
• Recovery plans: Documented, assigned and stored somewhere reachable when primary systems are down.
• Testing: Backups are restored on a schedule, and a full recovery or failover exercise runs at least annually with lessons recorded. DORA makes this testing an explicit requirement for financial entities.
• Third-party dependencies: Continuity arrangements of critical suppliers (cloud, payment, telecoms) are reviewed and exit strategies exist.

What this means for you: if your last audit focused only on the technical domains, add these four sections before the next one. They are where NIS2 and DORA auditors spend most of their time, and they are the sections a cyber security audit checklist built from a tool export tends to miss.

Checklist Maintenance & Continuous Improvement

A cybersecurity audit checklist should be a living document. Review and update it regularly (at least yearly, or whenever there are major tech or regulatory changes). For example, introduce new items if regulations change or if the organisation adopts new systems (cloud services, IoT, generative AI tools). After each audit, integrate lessons learned: if auditors consistently found a certain gap, add more detailed checks or controls in that area.

Automation and tools can help maintain the checklist. Use compliance platforms or scripts to "semi-automate" some checks (such as automatic verification of firewall rules, patch levels, or password policies). A SIEM or continuous monitoring solution can provide real-time alerts for some items on the list, reducing manual effort.

How DPO Consulting Supports Cybersecurity Audits

DPO Consulting offers end-to-end cybersecurity audit services built around these best practices:

• Full audit services: Our Audit Services team can conduct a comprehensive audit using the above checklist. We leverage industry frameworks to provide cyber audits to report on the cyber maturity state of your organisation. Where the goal is to prove compliance with a specific regulation, we run it as a Cybersecurity Compliance Audit with the obligations mapped to each control.
• Tailored for your industry/region: Audits can be customised based on the regulations or specific industry standards your organisation may be subject to. For example, we integrate GDPR, NIS2, DORA, PDPA (Asia), HIPAA (US healthcare) or other regulations into the checklist. Our multi-regulatory expertise (covering UK/EU GDPR, NIS2, DORA, CCPA, HIPAA and PDPA) means the audit will check the specific controls each standard requires. ISO 27001 controls or PCI-DSS requirements can also be incorporated where relevant.
• Remediation and training support: After the audit, we help in implementing the remediation roadmap. Our consultants can assist with policy updates, recommendations, or security awareness training for staff. Organisations without a security lead can add our CISO as a Service to own the roadmap.
• Continuous monitoring: We can also, thanks to our partners, set up or advise on SIEM and logging to provide ongoing oversight. This ties back to the audit: issues found can be monitored to prevent recurrence, closing the loop on continuous improvement.

Request a cybersecurity audit quote and we will scope the checklist to your systems and regulations within one call.

FAQ

How often should you run a cybersecurity audit?

Best practice is at least once per year. However, factors like industry, company size, and risk profile matter. Highly regulated sectors or companies with rapidly changing systems may audit more frequently (semi-annually or quarterly).

What's the difference between an audit and a vulnerability scan?

An audit is a broad, structured evaluation of controls, processes, and compliance across people, policies, and technology. It can include interviews, documentation review, policy checks, and technical tests. A vulnerability scan (or penetration test) is a technical tool-focused assessment that identifies known software/network weaknesses.

Can small companies use the same checklist as large enterprises?

In principle, yes. The fundamental controls (access management, patching, backups) are the same. But a small business will tailor the scope and depth. With fewer systems and simpler networks, some checklist items may be scaled down. For example, a startup might have one server instead of hundreds, so network segmentation checks are simpler. The audit should focus on the company's risk areas. Key controls (MFA, endpoint protection, incident plan) apply to any size, but the auditor will adjust based on the environment's complexity. CIS Implementation Group 1 is a good published baseline for a small company.

How do you choose relevant compliance frameworks to audit against?

Start with regulations that apply to your data and industry (e.g., GDPR if you handle EU personal data, HIPAA for health info, PCI-DSS for payment data). Then consider recognised security standards like ISO/IEC 27001, NIST Cybersecurity Framework, or industry-specific frameworks. These frameworks provide structured control sets.

What evidence is required to validate a control?

Auditors need proof that each control is implemented. This can include: system screenshots or configuration exports (e.g., firewall rule lists, user access lists), logs (showing events or changes), reports (e.g., latest vulnerability scan or patch report), and policy documents. For example, to prove an automatic patch process exists, you might show a console report with recent patch history. To validate logging, provide log files or SIEM entries.

What will be included in a cybersecurity audit checklist?

A cybersecurity audit checklist includes the scope and objectives, the documents to gather, and control checks across eight technical domains (access, network, data protection, endpoints, incident response, third parties, policy and training, physical security), plus governance, asset management, monitoring and business continuity. Each item names the evidence to collect and the standard or regulation it maps to.

What is the difference between a cybersecurity audit and a security assessment?

A cybersecurity audit tests whether defined controls exist and operate as intended, against a standard or regulation, and produces findings with evidence. A security assessment is broader and more exploratory: it measures the overall risk posture, often through a maturity model or a risk assessment, and recommends where to invest. Audits tend to produce pass/fail findings; assessments produce a scored picture and a roadmap.

How long does a cybersecurity audit typically take?

A focused audit of a small or mid-sized organisation typically takes two to four weeks from scoping to report, including a week of evidence collection and interviews. Enterprise or multi-site audits, or audits preparing for ISO 27001 certification, commonly run six to twelve weeks. Preparation quality is the biggest variable: organisations with a current asset inventory and policy set finish fastest.

Who should conduct a cybersecurity audit?

Internal audits can be run by a CISO or security team, provided they do not audit controls they own. Audits used as evidence for customers or regulators should be carried out by an independent party: an external consultancy, a certification body for ISO 27001, or a licensed CPA firm for SOC 2. Many organisations alternate an internal audit and an external audit each year.

References

• American Institute of Certified Public Accountants. (2022). 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022). https://www.aicpa.org/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
• Center for Internet Security. (2024). CIS Critical Security Controls, version 8.1. https://www.cisecurity.org/controls/v8
• European Parliament and Council. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 32, 33 and 83. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2016/679/oj
• European Parliament and Council. (2022). Directive (EU) 2022/2555 (NIS 2 Directive), Article 23. Official Journal of the European Union. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
• European Parliament and Council. (2022). Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2022/2554/oj
• International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems. Requirements. https://www.iso.org/standard/27001
• National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29