The components of strong cybersecurity plans, Part 3: Security auditing

Part 2 of this article appeared in the December 2017 issue of Compliance & Ethics Professional.

Mark Lanterman (mlanterman@compforensics.com) is Chief Technology Officer at Computer Forensic Services, Inc., in Minnetonka, MN.

In the last two articles of this series, I discussed the role of maturity assessment and security assessment as connected though distinct aspects of a strong security program. This article will delve into a third and comparatively more in-depth component. Security auditing builds upon the information collected as a result of the security assessment portion in order to come to conclusions about the efficiency of an organization’s internal controls.

A security audit focuses on the completeness, design, implementation, and efficacy of internal security controls. Although controls are identified during the security assessment to mitigate identified risks, a security assessment provides only a rudimentary evaluation of the control design. Perhaps more importantly, a security assessment is conducted under the assumption that the controls are effective in mitigating risks. Conversely, a security audit will delve much deeper into how a particular control is designed and how it is implemented over a period of review. Periods of review are decided by management based on the amount of assurance desired that a control is operating as expected. This period typically lasts 12 months but can ultimately be any length of time depending upon the needs of the organization.

This document is only available to members. Please log in or become a member.


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field