COR-3 - Independent Risk-Based Assessment
Control for independent internal and external cybersecurity audits
Control Definition
Internal and external audit programs must be maintained with a scope defined according to the risk profile, ensuring auditor independence and running audits at a frequency matching the criticality of the systems assessed. Independent third-party assessments including technical and maturity testing must be commissioned periodically, with their results presented to senior management and their execution planned to minimize impact on production. Compliance evidence must be managed centrally, and what, how and when information security performance should be measured and evaluated must be defined.
Requirements
Requirement 1
We define an internal cybersecurity audit program with a scope based on the risk profile.
Requirement 2
We define an external cybersecurity audit program with a scope based on the risk profile.
Requirement 3
We run internal audits of critical systems on a scheduled basis.
Requirement 4
We run external audits of critical systems on a scheduled basis.
Requirement 5
We plan audits by defining scope selection criteria and assessment procedures.
Requirement 6
We ensure internal auditors are functionally independent of the audited areas.
Requirement 7
We ensure external auditors are functionally independent of the company.
Requirement 8
We periodically commission cybersecurity assessments performed by independent, certified third parties.
Requirement 9
External assessments cover at least the most critical systems on a scheduled basis or when there are significant changes in the technology environment.
Requirement 10
We define when information security and cybersecurity should be monitored and measured.
Requirement 11
We define when the results of information security and cybersecurity monitoring and measurement should be analyzed and evaluated.
Requirement 12
We keep one or more internal audit programs active and up to date.
Requirement 13
We carefully plan audit tests and other assessment activities on production systems to minimize impact.
Requirement 14
We agree in advance with the responsible managers on carrying out audit tests and other assessment activities on systems.
Requirement 15
We include penetration tests, architecture reviews and maturity assessments in external assessments.
Requirement 16
We formally report audit findings.
Requirement 17
We present the results of external assessments to senior management.