Legal, Risk and Compliance · Topic 4 of 6
Audit Planning, ISMS and Specialized Compliance
CCSP audit planning: gap analysis, ISMS and internal controls, policies, stakeholders, NERC CIP, HIPAA, HITECH, PCI and distributed IT in cloud.
- 5 min
- Gap analysis compares current state with a target using control analysis, baselines and RCSA.
- An audit plan sets objectives, scope, criteria, evidence, resources and reporting.
- ISO/IEC 27001:2022 specifies the ISMS; Annex A has 93 controls in four themes.
What it is
Before and around any audit sits the organization's own assurance machinery: a planned audit program, gap analysis against requirements, an information security management system, an internal controls system, policies, and the right stakeholders. Highly regulated industries add specialized requirements, and the distributed nature of cloud spreads all of it across locations and jurisdictions.
How it works
Gap analysis
A gap analysis compares the current state with a target, such as a standard, regulation or policy, and lists what is missing.
| Technique | How it works |
|---|---|
| Control analysis | Map existing controls to required controls, for example to ISO/IEC 27001 Annex A or the CSA CCM |
| Baselines | Compare configurations and practices with an approved baseline |
| Risk and control self-assessment (RCSA) | Business units assess their own risks and how well their controls work, through workshops or questionnaires |
Gap analysis is often done before a formal audit or certification so that issues are fixed first. It should be performed by someone independent of the area for an objective result.
Audit planning
An audit plan defines:
- Objectives: what assurance the audit gives and to whom.
- Scope: systems, services, locations, providers and period.
- Criteria: the standard or requirements tested against.
- Approach and evidence: interviews, document review, configuration sampling, automated evidence from cloud APIs.
- Resources and schedule: auditor skills, including cloud expertise.
- Reporting: format, recipients and follow-up.
Cloud audits must also plan for what can be obtained from providers, which reports will be relied on, and how to test controls in environments that change constantly.
Internal ISMS
An information security management system (ISMS) is the set of policies, processes, roles and controls for managing information security risk, following a plan, do, check, act cycle. ISO/IEC 27001:2022 specifies its requirements, with Annex A listing 93 controls in four themes: organizational, people, physical and technological. An organization's ISMS should cover its cloud use, including provider management.
Internal information security controls system
The internal controls system is the set of controls management relies on, documented, owned and tested. Frameworks such as COSO structure it. Each control has an owner, a description, a frequency and evidence of operation, so internal and external auditors can test it.
Policies
| Level | Example |
|---|---|
| Organizational | Information security policy approved by senior management |
| Functional | Access control, encryption, incident response, acceptable use |
| Cloud computing | Approved providers and services, data permitted in cloud, region rules, shared responsibility duties, exit requirements |
Cloud policy should be aligned with existing policies, not a separate silo, and reviewed when services or laws change.
Identification and involvement of relevant stakeholders
Stakeholders include senior management, the board or audit committee, business owners, IT and cloud operations, legal, privacy, procurement, the provider and regulators. Involve them early to set scope, provide evidence and own remediation. Communication with providers needs a named contact and a contractual basis for obtaining evidence.
Specialized compliance for highly regulated industries
| Requirement | Industry | Key point for cloud |
|---|---|---|
| NERC CIP | North American bulk electric system | Cyber security standards for critical assets; strict controls on access, change and information about bulk electric system cyber systems |
| HIPAA | US healthcare | Business associate agreement required with providers handling PHI |
| HITECH Act | US healthcare | Extended HIPAA duties to business associates and strengthened breach notification |
| PCI DSS v4.0.1 | Organizations handling payment cards | Shared responsibility for each requirement must be documented between customer and provider |
Impact of the distributed IT model
Cloud spreads services across diverse geographic locations, crossing legal jurisdictions. For audit this means:
- Evidence may sit in several countries with different access rules.
- Different laws may apply to different parts of one service.
- Auditors may need to rely on reports from several providers and subservice organizations.
- Time zones, languages and local practices complicate fieldwork.
- Governance must be centralized even where operations are distributed.
A worked example
A hospital group plans an ISO/IEC 27001 certification that includes its cloud services. A gap analysis maps current controls to Annex A and finds no cloud policy, no documented shared responsibility for its SaaS electronic health record, and no business associate agreement with one analytics provider.
The audit plan sets scope, criteria and evidence sources, including the SaaS provider's SOC 2 report. Legal signs the missing business associate agreement, the CISO issues a cloud computing policy, and an RCSA is run with each clinical department before the certification audit.
How the exam asks about this
- "What should be done BEFORE a formal certification audit to find missing controls?" A gap analysis.
- "Which agreement is required under HIPAA when a cloud provider handles PHI?" A business associate agreement.
- "Which approach has business units assess their own risks and controls?" Risk and control self-assessment.
What to remember for the exam
- Gap analysis compares current state with a target using control analysis, baselines and RCSA.
- An audit plan sets objectives, scope, criteria, evidence, resources and reporting.
- ISO/IEC 27001:2022 specifies the ISMS; Annex A has 93 controls in four themes.
- Policies run from organizational to functional to cloud specific, and must align.
- NERC CIP for electric utilities; HIPAA and HITECH for health; PCI DSS for card data.
A distributed cloud does not distribute accountability. Governance and audit ownership stay with the organization even when operations span many countries and providers.
Common mistakes
Skipping the gap analysis. Going straight to certification wastes effort on findings that could have been fixed first.
Writing a cloud policy in isolation. It must connect to existing security, privacy and procurement policies.
Forgetting stakeholders outside IT. Legal, privacy, procurement and business owners hold evidence and own fixes.
Check yourself
What is a risk and control self-assessment?
A technique in which business units assess their own risks and the effectiveness of their controls, usually through workshops or questionnaires.
What did the HITECH Act change?
It extended HIPAA obligations directly to business associates and strengthened breach notification requirements.
What are the four themes of ISO/IEC 27001:2022 Annex A?
Organizational, people, physical and technological controls.
Topic 4 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.