My fancy padlet by Sia Jin Er

Introduction

i19018163 — 2024-01-10 07:40:54 UTC

ISACA has developed an audit/assurance program based on the NIST Cybersecurity Framework to provide organizations with a formal, repeatable way to evaluate cybersecurity controls.

Primary goal of a cybersecurity audit

i19018163 — 2024-01-10 07:41:58 UTC

Provide management with an appraisal of the efficacy of cybersecurity processes, policies, procedures, governance, and additional controls.

Audit Scope

i19018163 — 2024-01-10 07:56:09 UTC

1) Identify

Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

2) Protect

Develop and implement the appropriate safeguards to ensure the delivery of critical infrastructure services.

3) Detect

Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

4) Respond

Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.

5) Recover

Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

Minimum Audit Skills

i19018163 — 2024-01-10 08:08:18 UTC

Professionals engaged in IT audit and assurance must possess a comprehensive grasp of security and controls.
Given the dynamic nature of this field, those conducting the audit should ensure thorough research is undertaken to comprehend the underlying technologies employed in cybersecurity for identifying, protecting, detecting, and responding to cyber threats and attacks.
Nevertheless, it is imperative that the auditor also possesses adequate functional and business acumen to evaluate alignment with the organization's business strategy.