DER.3.1 Audits and Revisions

An organisation’s Top Management MUST appoint an employee who will be responsible for planning and initiating audits and revisions. The Top Management MUST ensure that there is no conflict of interests in this appointment.

The organisation MUST use audits and revisions to improve its security safeguards.

Prior to an audit or revision, an organisation MUST define the audit object and its corresponding goals. The affected contact partners MUST be informed. Depending on the object of the audit or revision, the employee responsible MUST inform the Employee Representatives of the planned audit or revision.

During an audit, the Audit Team MUST check whether the requirements of guidelines, norms, standards, and other relevant specifications are being fulfilled. The organisation being audited MUST be aware of these requirements.

The Audit Team MUST carry out a document check and an on-site audit during each audit process. During the on-site audit, the Audit Team MUST ensure that it never actively interferes with systems itself and does not issue instructions regarding changes to the audit object.

The Audit Team MUST document all the results of the audit in writing and summarise them in an audit report. The audit report MUST be submitted to the contact person of the organisation in a timely manner.

Within the framework of a revision, the Audit Team MUST check that the current requirements are being met in a complete, correct, and appropriate manner. The organisation in question MUST correct any deviations found as quickly as possible. The respective revisions MUST be documented in a revision history.

An organisation SHOULD provide a policy for internal ISMS auditing. It SHOULD also establish a policy on the management of corrective action. These policies SHOULD specify that regular audits and revisions are part of the security process and initiated by said process.

Furthermore, the CISO SHOULD ensure that the results of audits and revisions are returned to the ISMS and incorporated into its improvement. The CISO SHOULD include the audits and revisions carried out and their results in their regular report to the organisation's Top Management. This SHOULD also detail the deficiencies eliminated and the quality improvements made.

An organisation SHOULD establish a uniform basis for audits. A uniform evaluation scheme SHOULD be defined and documented for evaluating the implementation of requirements.

The CISO SHOULD draw up an audit program that contains all the audits and revisions to be performed in the next several years. Objectives SHOULD be defined for the audit program that are derived in particular from the information security goals at hand and the aims of the corresponding organisation.

The CISO SHOULD provide for contingency reserves in the organisation's annual resource planning. The audit program SHOULD be subject to its own continuous improvement process.

The CISO SHOULD maintain one or more revision lists that document the current status of the revision objects and the scheduled revisions.

An organisation SHOULD assemble a suitable team for every audit and revision. It SHOULD appoint a leading auditor (Audit Team Leader) or a leading revisor. This person SHOULD take complete responsibility for carrying out the audits or revisions.

The size of the Audit Team or revision team SHOULD correspond to the area to be audited. In particular, the organisation SHOULD consider the competencies required for the subjects of an audit and the size and local distribution of the area to be audited. The members of the audit or revision team SHOULD be appropriately qualified.

The neutrality of the Audit Team SHOULD be guaranteed. The revisors SHOULD also be independent. If external service providers are deployed as auditors or revisors, their independence SHOULD be checked and they SHOULD be obliged to maintain confidentiality.

Prior to an audit or a major revision, the Audit Team Leader or the lead revisor SHOULD create an audit or revision plan. For audits, the audit plan SHOULD be part of the final audit report. The audit plan SHOULD be updated throughout the audit and adjusted as required. Minor revisions SHOULD be scheduled according to the revision list.

The respective organisation SHOULD provide sufficient resources to the Audit Team or revision team.

The Audit Team SHOULD set clear rules for the exchange of information between the Audit Team or revision team and the employees of the organisation or department to be audited. The Audit Team SHOULD use suitable safeguards to ensure that the information shared in an audit remains confidential and its integrity remains intact.

Persons supporting the audit SHOULD NOT influence its activities. Furthermore, they SHOULD be obliged to maintain confidentiality.

The Audit Team or revision team SHOULD hold an initial meeting with the relevant contact persons. The audit or revision procedure SHOULD be explained and the framework conditions of the on-site audit agreed. The respective persons in charge SHOULD confirm this.

The documents SHOULD be checked by the Audit Team based on the requirements defined in the Gap Analysis Plan. All the relevant documents SHOULD be reviewed as to whether they are up to date, complete, and comprehensible. The results of the document check SHOULD be documented. To the extent that doing so makes sense, the results SHOULD also be incorporated into the on-site audit.

The Audit Team SHOULD select the samples for the on-site audit in a risk-oriented manner and justify them in a comprehensible way. The selected samples SHOULD be documented. If the audit is being performed based on the target objects and requirements of an IT-Grundschutz module, these SHOULD be selected on the basis of a previously defined method. When selecting samples, the results of previous audits SHOULD be taken into consideration, as well.

The Audit Team SHOULD implement suitable methods for each of the areas to be audited. Furthermore, it SHOULD be ensured that all audits are proportionate to the situation at hand.

The Audit Team SHOULD set the schedule of the on-site audit together with the contact person in question. The results SHOULD be documented in the audit plan.

At the beginning of an on-site audit, the Audit Team SHOULD hold an initial meeting with the persons in charge at the organisation concerned. Afterwards, all the requirements specified in the Gap Analysis Plan SHOULD be checked using the audit methods defined. If a selected sample deviates from the documented status, the sample SHOULD be extended as needed until the issue is clarified. The Audit Team SHOULD conduct a closing meeting after the audit. It SHOULD briefly present the results (without assessments) and explain the steps ahead. The meeting SHOULD be documented in writing.

The Audit Team SHOULD conduct structured interviews. Questions SHOULD be concise, precise, and easy to understand. In addition, appropriate interviewing techniques SHOULD be used.

The Audit Team SHOULD check that the remaining residual risks are appropriate and acceptable for the information domain concerned. It SHOULD also check whether the organisation's Top Management has acknowledged its acceptance of these risks in a binding manner. Safeguards that fundamentally support the information security of the entire organisation MUST NOT be included in this assumption of risk.

The auditor SHOULD verify at random whether and to what extent the safeguards defined in the risk treatment plan have been implemented.

The Audit Team SHOULD conduct a closing meeting with the respective persons in charge at the audited organisation. This SHOULD present the preliminary audit findings and lay out the next steps.

After an on-site audit, the Audit Team should further consolidate and evaluate the information gained. After any additional information and documentation requested after the fact are analysed, the audited safeguards SHOULD be subjected to a final evaluation. The Audit Team SHOULD allow the organisation in question a sufficient time frame for providing the requested documentation. Documents not received by the agreed date SHOULD be considered non-existent.

The Audit Team SHOULD transfer the results obtained into an audit report and document them transparently.

The organisation audited SHOULD ensure that all the entities affected are provided with the sections of the audit report that are important and necessary for them within an appropriate time frame.

The results of a revision SHOULD be documented uniformly by the revision team.

After the audit or revision, all the relevant documents, data storage media, and IT systems SHOULD be returned or destroyed. This SHOULD be coordinated with the audited organisation. In doing so, storage obligations resulting from legal or other binding requirements SHOULD be taken into account accordingly. Furthermore, the CISO SHOULD have all the forms of access granted to the Audit Team or revision team disabled or deleted.

There SHOULD be an agreement with the auditors or revisors as to how the results are to be handled. This SHOULD also establish that the audit results must not be forwarded to other organisations without the consent of the audited organisation.

The audited organisation SHOULD eliminate the deviations or shortcomings identified in the audit report or within the framework of a revision within a reasonable period of time. The corrective measures to be taken SHOULD be documented, along with the corresponding deadlines and the persons responsible. Corrective measures that have been completed already SHOULD also be documented. The organisation SHOULD establish and use a defined procedure for this purpose.

In the event of serious deviations or shortcomings, the Audit Team or revision team SHOULD check whether the corrective measures have been carried out.

The audit program followed SHOULD be monitored and adapted continuously to ensure compliance with regard to dates, audit objectives, audit contents, and audit quality.

The appropriateness of the audit program SHOULD be checked based on the requirements it is meant to fulfil and the results of the audits performed. It SHOULD be adapted as necessary.

The organisation in question SHOULD file and store audit programs and documents on audits and revisions in a traceable and audit-proof manner in accordance with regulatory requirements. This SHOULD ensure that only authorised persons can access audit programs and documents. The organisation SHOULD securely destroy the audit programs and documents after the retention period has expired.