Cybersecurity Audit

A cyber security audit assesses the existence and effectiveness of the controls an organisation has put in place to protect its information assets. It is not confined to technical controls: governance elements such as policy, access authorisation, supplier management and incident response are also in scope.

The aim is to identify the attack surface and the gaps in controls before an incident occurs.

• Technology companies whose customers request security assurance
• Organisations establishing or maintaining ISO/IEC 27001
• Businesses in critical infrastructure and regulated sectors
• Organisations processing card data (within PCI DSS scope)
• Firms within scope of a supplier security assessment

The criteria are the framework applied: the ISO/IEC 27001 Annex A controls, IEC 62443 (industrial), PCI DSS, the NIST CSF, or CIS Controls. Applying an IT framework directly in an industrial environment gives the wrong result; criteria suited to OT must be chosen.

• Information-security policies and the governance structure
• Asset inventory and classification
• The risk-assessment process and the Statement of Applicability
• Identity and access management, privileged accounts
• Network segmentation and perimeter security
• Endpoint protection and patch management
• Cryptography and key management
• Logging, monitoring and detection capabilities
• Backup and restoration testing
• Secure software-development practices
• Supplier and cloud-service-provider security
• The incident-response plan and its exercises
• Business continuity and disaster recovery
• Awareness training and the human factor

• ISO/IEC 27001
• ISO/IEC 27002
• IEC 62443
• PCI DSS
• NIST CSF
• ISO 19011

1. 1Selecting the Criteria to ApplyThe standard, scheme or legislation against which the audit will be performed is determined; in subject-specific audits the choice of criteria directly determines what the result means.
2. 2Risk Assessment and ScopeRisk areas are identified according to the organisation's activity and location; the number of audit days is planned accordingly.
3. 3Review of Documents and RecordsPolicies, procedures, permits, measurement records and the results of previous audits are examined.
4. 4On-site AuditThe relevant areas are walked; subject-specific measurements, observations and record checks are made.
5. 5Worker InterviewsWhere the subject requires it, confidential interviews with workers are held independently of management; statements are compared with the records.
6. 6Assessment of Legal ComplianceCompliance with the legislation in force is checked separately; a legal nonconformity is the most serious category of finding in every scheme.
7. 7Reporting of FindingsFindings are classified by severity and compiled into a report.
8. 8Corrective Action and Follow-upA corrective action plan is obtained; its close-out within the period prescribed by the scheme is followed up.

Findings are prioritised by risk level. A directly exploitable vulnerability and a missing policy document do not carry the same weight; this distinction is made explicitly in the report, and the order of remediation is recommended based on risk.

• Details of the audit body, the auditor and the auditee
• Standard, scheme or legislation applied
• Date, duration and scope of the audit
• Findings from the review of documents and records
• On-site observations and measurement results
• Findings from worker interviews, where held
• Assessment of legal compliance
• Findings, their severity and the supporting evidence
• Corrective action plan and time limits

A cybersecurity audit assesses whether controls exist and how they are designed; it does not guarantee that every control is working effectively at every moment. The audit shows the situation at a given date, and the threat landscape is constantly changing. The audit is also not a penetration test: whether vulnerabilities are actually exploitable is a separate technical testing matter.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Social Compliance Audit
• Environmental Audit
• OHS Audit
• Energy Audit
• Data Protection Audit
• ESG Audit