6.5 Security Audits

Key Takeaways

CISSP 6.5 focuses on conducting or facilitating security audits.

The current CISSP outline explicitly includes internal, external, third-party and location-based audits covering on-premises, cloud and hybrid environments.

An audit systematically obtains and evaluates evidence against defined audit criteria.

The basic audit relationship is:

Criteria → Evidence → Comparison → Conclusion.

The audit objective explains why the audit is being performed.

Audit scope identifies the systems, processes, locations, organisational units and periods included.

Audit criteria define the policies, standards, laws, contractual obligations or other requirements against which evidence is evaluated.

Objective = why. Scope = what. Criteria = against what.

Assessment, testing and auditing are related but distinct.

Assessment broadly evaluates security effectiveness.

Testing exercises controls and systems.

Auditing compares objective evidence against established criteria.

Assess = effective? Test = works? Audit = conforms?

Credible audits depend on integrity, fair presentation, due professional care, confidentiality, independence and evidence-based evaluation.

Risk-based auditing directs greater assurance effort toward areas where failure could create greater organisational impact.

An audit programme coordinates multiple audits over time, while an individual audit is a specific engagement.

The audit lifecycle generally includes planning, preparation, fieldwork, evidence evaluation, reporting and follow-up.

Internal audits are performed by or on behalf of the organisation itself.

Internal auditors can provide strong assurance when appropriate independence and objectivity exist.

Internal does not mean informal.

First-party audit commonly refers to internal audit.

Second-party audit commonly refers to an interested party auditing an organisation with which it has a relationship, such as a customer auditing a supplier.

Third-party audit commonly refers to an independent auditing organisation, such as a certification body.

First = ourselves. Second = business relationship. Third = independent.

CISSP separately lists internal, external and third-party contexts, while some formal audit terminology groups second- and third-party activity under external auditing.

Auditor independence reduces the risk that conclusions are improperly influenced by responsibility for the activity being audited.

An auditor who designed or operates the control may create a self-review concern.

Independence alone is not enough.

Auditors must also have sufficient competence to understand the audit methodology, technology, business environment and applicable criteria.

Independent + competent + evidence-based = stronger assurance.

Third-party audits are particularly important where organisations depend on suppliers, cloud services, SaaS platforms and managed-service providers.

Contracts can establish audit rights, evidence requirements and assurance obligations before dependency on a supplier is created.

Existing third-party audit reports can provide useful assurance, but their scope, criteria, period, independence, exceptions and relevance should be evaluated before relying on them.

Audit report exists ≠ audit report covers your risk.

SOC reports are commonly used to provide assurance regarding controls at service organisations.

SOC 1 concerns controls relevant to user entities' internal control over financial reporting.

SOC 2 addresses controls relevant to Trust Services Criteria involving security, availability, processing integrity, confidentiality and privacy.

SOC 3 also relates to Trust Services Criteria but provides a general-use report rather than the detailed restricted-use information associated with SOC 2.

SOC 1 = financial reporting. SOC 2 = Trust Services detailed report. SOC 3 = Trust Services general-use report.

SOC 2 should not be described as a generic "SOC 2 certification."

Type 1 reports evaluate controls at a specified point in time.

Type 2 reports include evaluation of operating effectiveness during a defined period.

Type 1 = point in time. Type 2 = over time.

Third-party reports may depend on complementary controls that the customer is responsible for implementing.

Provider assurance does not prove that customer-controlled identities, configurations or permissions are secure.

Cloud audits therefore require an understanding of shared responsibility.

Hybrid audits should evaluate not only on-premises and cloud controls but also the federation, network connectivity, APIs, data flows and other trust relationships connecting them.

Secure A + Secure B ≠ Secure A-to-B relationship.

Audit conclusions require appropriate evidence.

Evidence may include documentation, records, logs, configurations, interviews, observations, technical tests and reperformance.

Important assertions can be corroborated using multiple evidence sources.

Management statements can provide useful information, but significant conclusions should normally be supported by appropriate objective evidence.

Audit evidence should be relevant, reliable, sufficient, current and traceable to the conclusion it supports.

Tell me → Show me → Prove it.

Sampling can be used where testing every item in a population is impractical.

Sampling introduces the possibility that the selected items do not perfectly represent the wider population.

Allowing an auditee to provide only its best examples can undermine the reliability of the sample.

Audit trails support accountability by recording who performed an action, what happened, when it happened and where it occurred.

Audit trails and other audit evidence should themselves be protected against inappropriate modification or deletion.

Audit findings connect the expected state defined by criteria with the actual state demonstrated by evidence.

Depending on the audit framework, deviations may be described using terms such as findings, exceptions, deficiencies, observations or nonconformities.

Terminology can vary; evidence and criteria are what matter.

Audit documentation and workpapers record the procedures performed, evidence obtained and basis for conclusions.

Significant findings should be traceable to the evidence supporting them.

Risk and significance should be considered rather than treating every audit deviation as equally important.

Audit reports should describe objective, scope, criteria, methodology, findings, limitations and conclusions as appropriate.

Audit scope constrains the conclusion.

Passing one security audit does not demonstrate that every system, control or threat across the organisation has been evaluated.

Compliance with audited criteria ≠ absence of all security risk.

Management should have an opportunity to provide relevant evidence and factual clarification before findings are finalised.

Auditor independence does not mean refusing to correct a finding when better evidence demonstrates that it is wrong.

Management is normally responsible for corrective action and risk decisions arising from audit findings.

Follow-up provides evidence that agreed corrective action actually occurred.

Management says fixed ≠ auditor has verified closure.

Repeated findings can indicate ineffective remediation, inadequate accountability or systemic control weaknesses.

Audit reports and workpapers can reveal sensitive information about vulnerabilities, control gaps, architecture and third-party weaknesses and should therefore be appropriately protected.

Continuous monitoring and continuous auditing are different concepts.

Continuous monitoring is generally a management activity that observes control and risk conditions.

Continuous auditing uses recurring or automated audit procedures to provide assurance more frequently.

Automation can increase audit coverage and frequency, but auditors still need to establish that data sources, automated logic and audit criteria are reliable.

The central CISSP principle is: define what should be true, obtain trustworthy evidence of what is actually true, evaluate the difference objectively and communicate the resulting assurance to the people who need it.