Apologies everyone for the long delay between posts but I hope you enjoyed the last two on network security, and especially Vulnerability Management(which was our most popular posting to date!). Now that the holidays are over and I have settled into my new role lets continue running through the second half on the ISO27001:2013 controls.
This post will be shorter than the previous ones as we are only dealing with one control;
Security category – 12.7. Information systems audit considerations
12.7.1. Information systems audit considerations.
Any audit of information systems should be carefully planned, and have coverage agreed on in advance with the goal of minimizing disruption to business operations. While audits are an amazing tool for finding gaps and weaknesses in our security standing. Auditors are observers. The audit should not change any of the information stored on assets being reviewed and the auditors access should be monitored and logged.
Ideally the auditor should have read only access and should only run their audit scripts outside of business hours to minimize disruption.
Adams In-Security 