Auditing2e ppt15 l04

Auditing IT Infrastructures for
Compliance
Lesson 4
Auditing Standards and Frameworks
© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com
All rights reserved.
Learning Objective
▪ Explain the scope of an IT audit for
compliance and the use of standards and
frameworks.

Auditing IT Infrastructures for Compliance www.jblearning.com Page 2
Key Concepts
▪ What a framework is and why it's important for
auditing IT security compliance
▪ The importance of using standards in compliance
auditing
▪ The role of control objectives and control activities
▪ IT security standards and frameworks, such as NIST,
ISO27000, Control Objectives for Information and
Related Technology (COBIT), Service Organization
Control (SOC) reports, and Committee of Sponsoring
Organizations (COSO)
▪ Selecting a standard for auditing security compliance

Framework
▪ A conceptual set of rules and ideas that provide

structure to a complex and tough situation
▪ May be rigid in structure but provides flexibility
▪ Can guide content and provide consistency
▪ Includes distinct components: Introduction,
learning objectives, headings, and a summary

Control Objectives/Activities
Control Objectives
• High level, remain almost constant
• Describe organizational goals
Control Activities
• More specific
• Describe how to achieve goals

Auditing—Standards and
Frameworks
Conduct audits and assessments with a standard
Control objectives remain constant
Control activities achieve goals of control objectives

Framework Controls
Descriptive
• High level
• Align IT with business goals
Prescriptive
• More specific
• Standardize IT operations and tasks

Standard and Framework
Attributes
Industry
acceptance
Prioritization
Reasoning
Flexibility
Depth and
breadth

Information Security Policy Framework
Policies Standards
Policy
Framework
Guidelines Procedures

Selecting a Standard
Evaluate Select Employ

Hierarchy of Standards and
Personnel
Controls
ISO 27001, NIST 800-53

Standards and Frameworks -
COSO
▪ Used for improving organizational

performance and governance, and reducing
fraud in organizations

Standards and Frameworks –
COSO (Con’t)
COSO Internal environment
enterprise
risk Objective setting
management
(ERM) Event identification
framework
Risk assessment
Risk response
Control activities
Information and communication
Monitoring

Standards and Frameworks:
COBIT

COBIT 5
Meeting stakeholder needs
Covering the enterprise end to end
Applying a single integrated framework
Enabling a holistic approach
Separating governance from management

Using COBIT to Align
Requirements
Mapping Classifying IT Identifying Defining the

controls to activities into the key IT framework
key business a process resources to for control
requirements model be controlled objectives

Service Organization Controls
(SOC)
▪ SOC Reports
• Help customers understand adequate controls and
processes are in place
• Auditing Standards Board of the American
Institute of Certified Public Accountants (AICPA)
issues and maintains auditing standards
• Stakeholders include user entities, service
organizations, and auditors

Standards and Frameworks
▪ International Organization for

Standardization (ISO) 27000 series
• Focuses on management and processes
• Relies on other standards
- ISO
- International Electrotechnical Commission
(IEC) 27002

Standards and Frameworks
▪ NIST 800-53
• Provides a comprehensive catalog of
security controls
• Targeted to federal government but widely
used in corporations
• Controls include management, technical,
and operational
• Catalog of controls is grouped into 18
families of controls
NIST Cybersecurity Framework
Core Profile
Implementation
Tiers

Hybrid Auditing Framework
▪ Uses same approach for internal and
external audits (COSO and COBIT)
▪ Allows operations-focused audits to
combine with IT-focused audits
▪ Select appropriate frameworks

▪ Adopt risk-based approaches
▪ Map business processes to IT processes

Summary
▪ What a framework is and why it's important for
auditing IT security compliance
▪ The importance of using standards in compliance
auditing
▪ The role of control objectives and control activities
▪ IT security standards and frameworks, such as
27001, Control Objectives for Information and
Related Technology (COBIT), Service Organization
Controls (SOC) reports, and Committee of
Sponsoring Organizations (COSO)
▪ Selecting a standard for auditing security compliance

Lab
▪ Aligning Auditing Frameworks for a Business Unit
within DoD


Auditing2e ppt15 l04

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Auditing2e ppt15 l04

Uploaded by

Copyright:

Available Formats

Auditing IT Infrastructures for

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

▪ A conceptual set of rules and ideas that provide

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Conduct audits and assessments with a standard

Control objectives remain constant

Control activities achieve goals of control objectives

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Evaluate Select Employ

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

▪ Used for improving organizational

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Covering the enterprise end to end

Applying a single integrated framework

Enabling a holistic approach

Separating governance from management

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Mapping Classifying IT Identifying Defining the

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

▪ International Organization for

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

▪ Select appropriate frameworks

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2016 Jones and Bartlett Learning, LLC, an Ascend Learning Company

You might also like