Auditing

---

Product audits focus on specific features, such as application code.

System/process audit is an audit process with a wide scope, including assessment of supply chain, configuration, support, monitoring, and cybersecurity factors.

Security audits assess an organization’s security controls, policies, and procedures, often using standards like ISO 27001 or the NIST Cybersecurity Framework as benchmarks.

Cybersecurity audits are comprehensive reviews designed to ensure an organization’s security posture aligns with established standards and best practices.

• types
  • compliance audits
    • assess adherence to regulations
  • risk-based audit
    • identify potential threats and vulnerabilities in an organization’s systems and processes
  • technical audits
    • delve into the specifics of the organization’s IT infrastructure
    • examine areas like network security, access controls, and data protection measures
• e.g.,
  • penetration testing
    • is a technical audit
    • is also a compliance audit
      • regulations require regular pen testing
      • PCI DSS