IS Audit Basics: Auditing Cybersecurity

There are several rites of passage one goes through on the way to becoming an experienced IT auditor. After completing college, one gets a job, although not necessarily in audit. After a while, audit attracts and so one moves into the area and sits and passes the Certified Information Systems Auditor (CISA) exam. One then works as part of an audit team before finally progressing to performing solo IT audits. As a practitioner becomes more experienced, he or she will (hopefully) lead a team and become an IT audit director.

However, in recent years, something additional has been added to the rite of passage. Increasingly, IT auditors are being asked to audit cybersecurity. I say increasingly because when I moved into IT audit in 2005 the term was not commonly used.¹ We just audited plain old IT security. Now, it is probably one of the first items in an enterprise’s audit universe.

So, what is cybersecurity and how do we audit it? We will, once again, turn to the ISACA white paper on creating audit programs.²

Determine Audit Subject

The first thing to establish is the audit subject. What does cybersecurity mean in the enterprise? ISACA defines cybersecurity as “the protection of information assets by addressing threats to information processed, stored and transported by internetworked information systems.”³ This is quite a wide definition.

In fact, the cybersecurity audit universe includes all control sets, management practices, and governance, risk and compliance (GRC) provisions in force at the enterprise level. In some cases, the extended audit universe may include third parties bound by a contract containing audit rights.⁴ Boundaries and limitations to consider for cybersecurity audits include:⁵

• Corporate sphere of control vs. private sphere of control—In most enterprises, end users may engage in activities that are only partially covered by the business purpose. This includes the use of private IT devices and nonstandard applications.
• Internal IT infrastructure vs. external infrastructure—As a rule, the use of IT extends beyond the internal organizational network, as in traveling use, home-use settings or the adoption of the cloud. While this may create additional cybersecurity risk, it has become common practice in most enterprises.

Further, the audit universe may be extended by reliance on the work of others. Examples include information security management system (ISMS) certification reports, International Standard on Assurance Engagements (ISAE) ISAE 3402 reports or published regulatory review results. IT auditors should identify and categorize audit areas where reliance on the work of others makes sense.⁶

The key is to consider the cybersecurity-related areas in the enterprise and to determine the audit subject(s). One needs to answer the key question: What is being audited? Given the depth and breadth of the subject matter, it may also be worth creating multiple, individual audit universe items.

Define Audit Objective

Once what is being audited has been decided, the objective of the audit needs to be established. Why is it being audited? From an auditor’s perspective, it is advisable to adopt a risk-based view (figure 1) and define the objectives accordingly.

The audit objectives should be limited to a reasonable scope and should also correspond to cybersecurity and protection goals as defined by the enterprise (figure 2).

Set Audit Scope

Once the objectives for the audit have been defined, the planning and scoping process should identify all areas and aspects of cybersecurity to be covered. In other words, what are the limits to the audit? This could include a specific country, region, division, process area or aspect of cybersecurity. Again, this should be risk based.

Cybersecurity audit scopes are usually more restricted than those for general IT audits due to the higher level of complexity and technical detail to be covered. For an annual or multiyear scope, it is advisable to break down the overall scope into manageable audits and reviews, grouping them by area addressed and by approach.⁷

Perform Pre-Audit Planning

Now that the risk scenarios have been identified (figure 2), they should be evaluated to determine their significance. Conducting a risk assessment is critical in setting the final scope of a risk-based audit.⁸ The more significant the risk, the greater the need for assurance.

Assurance considerations for cybersecurity have been well documented in the US National Institute for Standards and Technology (NIST) Cybersecurity Framework (CSF).⁹ The CSF focuses on using business drivers to guide cybersecurity activities and considering cybersecurity risk as part of the organization’s risk management processes.¹⁰ One of the strongest features of the CSF is the Framework Core (figure 3). This core is a set of cybersecurity activities, desired outcomes and references from industry standards, guidelines and practices.¹¹

Each defined function, for example, “Identify,” is broken down to defined categories, for example, “Asset Management.” These, in turn, are broken down to sub-categories, which are mapped to informative references (figure 4).

This is powerful, as it allows the IT auditor to focus on areas that may require assurance. For example, if the enterprise under review has successfully implemented International Organization for Standardization (ISO) ISO 27001 Information security management systems, there may not be a need to confirm that physical devices and systems are inventoried if one relies on the work completed by the ISO auditor.

Determine Audit Procedures and Steps for Data Gathering

At this stage of the audit process, the audit team should have enough information to identify and select the audit approach or strategy and start developing the audit program.¹² However, the testing steps do need to be defined.

In 2016, ISACA released an audit/assurance program based upon the NIST CSF,¹³ which defines testing steps for cybersecurity. As always, audit/assurance programs should be considered a starting point and adjusted based upon risk and criteria that are relevant to the organization being audited. Failure to do so can result in a checklist approach, which can lead to the auditor recommending controls that are not applicable to the organization. This, in turn, can damage the auditor’s reputation with the auditee and, ultimately, with senior management.¹⁴ It is, therefore, worth spending the time considering the identified audit objectives and need for assurance (figure 5).

Conclusion

Cybersecurity risk affects an organization’s bottom line. It can drive up costs and affect revenue. It can harm an organization’s ability to innovate and to gain and maintain customers.¹⁵ The proliferation, complexity and, dare one say it, near ubiquity of cyberattacks means that all IT auditors will be required to develop cybersecurity audit capabilities. As a leading advocate for managing this risk, ISACA has made several developments in this area including white papers, an audit program based upon the NIST CSF and a cybersecurity audit certification.¹⁶ All IT auditors should utilize these tools to help protect enterprises from cybersecurity risk.

Endnotes

¹ Merriam Webster, cybersecurity definition, https://www.merriam-webster.com/dictionary/cybersecurity. Interestingly, according to Merriam-Webster, the first known use of the term was in 1989.
² ISACA, Information Systems Auditing: Tools and Techniques, Creating Audit Programs, USA, 2016
³ ISACA Glossary, Cybersecurity, www.isaca.org/resources/glossary
⁴ ISACA, Transforming Cybersecurity, USA, 2013
⁵ Ibid.
⁶ Ibid.
⁷ Ibid.
⁸ ISACA, Audit Plan Activities: Step-By-Step, USA, 2016
⁹ National Institute for Standards and Technology, Framework for Improving Critical Infrastructure Cybersecurity, USA, 2018, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
¹⁰ Ibid.
¹¹ ISACA, Implementing the NIST Cybersecurity Framework Using COBIT 5, USA, 2017
¹² Op cit Audit Plan Activities: Step-By-Step
¹³ ISACA, IS Audit/Assurance Program, Cybersecurity: Based on the NIST Cybersecurity Framework, USA, 2017
¹⁴ Cooke, I.; “Audit Programs,” ISACA Journal, vol. 4, 2017, www.isaca.org/resources/isaca-journal/issues
¹⁵ Op cit, Framework for Improving Critical Infrastructure Cybersecurity
¹⁶ ISACA, Cybersecurity Audit Certificate