Security Assessment and Testing · Topic 1 of 3
Assessment and Audit Strategies
Designing assessment, test and audit strategies, internal, external and third-party audits, SOC reports, auditor independence and facilitating security audits.
- 4 min
- Strategy: objectives, scope, frequency, methods and assessors.
- Internal by your own staff, external by an outside firm you engage, third-party by or for another organization such as a customer or regulator.
- SOC 1 financial, SOC 2 security trust criteria, SOC 3 public; Type II covers a period.
What it is
An assessment strategy decides what will be tested, how, how often, by whom and against which standard. Audits are formal, independent examinations of whether controls meet requirements. Security managers both design assessments and support auditors.
How it works
Designing the strategy
- Objectives: compliance, assurance to customers, finding weaknesses before attackers do.
- Scope: systems, locations (on premises, cloud, hybrid), processes and third parties.
- Frequency: based on risk and on how fast the environment changes; continuous monitoring for fast-changing systems.
- Methods: automated scanning, manual testing, interviews, document review and observation.
- Assessors: internal staff, external firms or third-party certification bodies.
Types of audits
| Type | Performed by | Example |
|---|---|---|
| Internal | The organization's own staff or internal audit | Internal control review |
| External | An outside audit firm the organization engages | Independent assessment of the organization's controls |
| Third-party | Another organization, or auditors acting for it, such as a customer or regulator | Customer audits a vendor under contract, regulator examination, SOC report for customers |
Terms vary between sources. ISO audit practice calls internal audits first-party, a customer auditing its supplier second-party and an independent certification body (for example for ISO/IEC 27001) third-party. Read the scenario for who initiates and controls the audit.
SOC reports
| Report | Content | Audience |
|---|---|---|
| SOC 1 | Controls relevant to financial reporting | Customers' financial auditors |
| SOC 2 | Controls for security, availability, processing integrity, confidentiality and privacy | Customers under NDA |
| SOC 3 | Summary of SOC 2 for public use | General public |
| Type I | Design of controls at a point in time | |
| Type II | Operating effectiveness over a period (often 6 to 12 months) | Stronger assurance |
A qualified opinion means some controls did not meet criteria. Assess the exposure, add compensating checks and ask the vendor for a remediation plan.
Auditor independence
Auditors must not audit their own work. If internal audit helps design a process, it should not later evaluate that same process, or its objectivity is compromised. Internal audit reports to the audit committee or board to stay independent of the management it audits.
When choosing between a self-assessment and an independent assessment for assurance, independence wins.
Facilitating audits
| Stage | Security manager's role |
|---|---|
| Planning | Agree scope, timing and evidence needs |
| Fieldwork | Provide accurate evidence and access; arrange interviews |
| Findings | Respond honestly; agree corrective actions with owners and dates |
| Follow-up | Track remediation and provide evidence of closure |
Never hide gaps, coach staff to mislead auditors or rewrite procedures to match practice after the fact. Acknowledge findings and present a dated corrective plan.
Assessments in cloud and outsourced environments
You often cannot audit a cloud provider directly. Rely on its third-party reports (SOC 2, ISO certificates), contractual rights, and your own testing of what you control (configurations, identities, data).
How the exam asks about this
- "A certification body audits against ISO/IEC 27001." An independent audit (a third-party certification audit in ISO terms).
- "A junior analyst tells the auditor the team ignores the procedure." Acknowledge the gap and offer a dated corrective plan.
- "Internal audit is asked to design a process and later audit it." Independence concern.
What to remember for the exam
- Strategy: objectives, scope, frequency, methods and assessors.
- Internal by your own staff, external by an outside firm you engage, third-party by or for another organization such as a customer or regulator.
- SOC 1 financial, SOC 2 security trust criteria, SOC 3 public; Type II covers a period.
- Auditors must stay independent of what they audit.
- Facilitate audits honestly and track remediation.
A SOC 2 report covers the scope and period it states. Check that the services you use and the dates are included.
Common mistakes
Treating a Type I report as proof that controls operate over time.
Letting auditors review their own designs.
Disputing or hiding findings instead of fixing them.
Check yourself
Which SOC report type covers operating effectiveness over a period?
Type II.
What kind of audit is a customer auditing its supplier?
A third-party audit in CISSP terms (ISO audit practice calls it second-party).
Why should internal audit not design a process it will later audit?
It would be reviewing its own work, compromising independence.
Topic 1 of 3 in Security Assessment and Testing
Test yourself on Security Assessment and Testing
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.