A friend of mine recently posted this to Linkedin. I believe it is a wonderful reference for Security folks to use in understanding what auditors are looking for. Credits go to Mervin Pearce (CISSP-ISSAP).
d
---------------------------------------------------------------------------------------------------------------------
Outlining an audit framework that aligns with NIST’s five core functions involves systematically assessing how an organisation meets the subcategories and categories defined by the NIST Cybersecurity Framework (CSF). The audit framework should evaluate the organisation’s current state, identify gaps, and provide recommendations to meet compliance or strengthen security. Here’s a breakdown of the audit approach aligned to the Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC) functions:
1. Identify (ID)
Objective:
To develop an understanding of the organisation’s environment to manage cybersecurity risk to systems, assets, data, and capabilities.
Audit Activities:
- Asset Management (ID.AM): Review asset inventories (software, hardware, data) to verify completeness and accuracy. Check for documented asset management procedures.
- Risk Assessment (ID.RA): Evaluate the organisation’s risk assessment methodology. Assess how risks are identified, prioritised, and mitigated.
- Supply Chain Risk Management (ID.SC): Examine vendor and third-party risk management processes, ensuring they assess and mitigate risks from supply chain partners.
- Governance (ID.GV): Assess how governance structures, roles, and responsibilities support risk management objectives and confirm that policies are aligned with cybersecurity objectives.
Key Audit Questions:
- Does the organisation maintain an accurate inventory of assets?
- How frequently are risks reassessed?
- Are third-party and supply chain risks adequately evaluated?
2. Protect (PR)
Objective:
To develop and implement appropriate safeguards to ensure the delivery of critical services.
Audit Activities:
- Access Control (PR.AC): Review access control policies and practices. Verify that multi-factor authentication (MFA) and least privilege principles are enforced.
- Awareness and Training (PR.AT): Evaluate the effectiveness of cybersecurity awareness programs and check the frequency and content of employee training.
- Data Security (PR.DS): Audit data protection controls, such as encryption, tokenisation, and data loss prevention (DLP) measures.
- Information Protection Processes (PR.IP): Ensure security policies, backup processes, and configuration management are well-documented and consistently applied.
- Maintenance (PR.MA): Verify system maintenance and check that security patches are applied in a timely manner.
Key Audit Questions:
- Are access controls consistent with the organisation’s security policies?
- How often are employees trained on cybersecurity best practices?
- Is sensitive data encrypted at rest and in transit?
3. Detect (DE)
Objective:
To develop and implement appropriate activities to identify the occurrence of a cybersecurity event.
Audit Activities:
- Anomalies and Events (DE.AE): Review monitoring systems for event logging and anomaly detection. Check how anomalies are identified and escalated.
- Security Continuous Monitoring (DE.CM): Assess the organisation’s use of intrusion detection systems (IDS), security information and event management (SIEM) tools, and regular vulnerability scans.
- Detection Processes (DE.DP): Verify that detection processes are consistently implemented, maintained, and updated. Ensure that detection procedures align with incident response protocols.
Key Audit Questions:
- Are security incidents detected in a timely manner?
- What technologies are used to monitor for anomalous behaviour?
- Are detection tools and processes regularly updated?
4. Respond (RS)
Objective:
To develop and implement appropriate activities to take action regarding a detected cybersecurity event.
Audit Activities:
- Incident Response Planning (RS.RP): Review the incident response (IR) plan. Check for detailed procedures, team roles, and communication protocols.
- Communications (RS.CO): Assess how incidents are reported both internally and externally. Review any communication templates or plans for breach notification.
- Analysis (RS.AN): Evaluate how incident data is collected, analysed, and used to determine impact. Check for root cause analysis post-incident.
- Mitigation (RS.MI): Verify that incidents are properly contained and eradicated. Review incident post-mortems and lessons learned.
- Improvements (RS.IM): Ensure there’s a process for refining and improving incident response capabilities after each incident.
Key Audit Questions:
- Is the incident response plan regularly tested and updated?
- How quickly are incidents reported to management and external stakeholders?
- What processes are in place for root cause analysis?
5. Recover (RC)
Objective:
To develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident.
Audit Activities:
- Recovery Planning (RC.RP): Audit the existence and comprehensiveness of disaster recovery and business continuity plans. Ensure backup and recovery solutions are in place and effective.
- Improvements (RC.IM): Assess how lessons learned from past incidents are integrated into recovery plans.
- Communications (RC.CO): Review communication strategies for recovery, ensuring that key stakeholders are informed in a timely and effective manner.
Key Audit Questions:
- Does the organisation regularly test its disaster recovery and business continuity plans?
- How quickly can critical services be restored after an incident?
- Is there a clear communication plan to inform stakeholders during recovery?
Additional Framework Elements:
Governance and Oversight (Cross-Function Audit):
By incorporating governance across all functions, the audit should evaluate:
- Leadership engagement: Are leaders involved in defining and overseeing cybersecurity strategy?
- Compliance checks: Are regulatory and legal requirements (such as GDPR and HIPAA) integrated into the framework?
- Metrics and reporting: What metrics are used to report cybersecurity posture to stakeholders and the board?
Reporting and Recommendations:
The final audit report should:
- Summarise findings across the five core functions.
- Highlight critical gaps or weaknesses.
- Provide a maturity rating for each function (e.g., Initial, Managed, Defined, Optimised).
- Offer practical recommendations for remediation and improvement.
