+DER.3.2.A17 Conducting the On-Site Audit [IS Audit Team] (S)

DER.3.2.A17 Conducting the On-Site Audit [IS Audit Team] (S)

The IS Audit Team SHOULD investigate and determine whether the selected measures for the on-site audit meet the requirements of IT-Grundschutz in a practical and adequate manner.

The audit SHOULD start with an initial meeting. All the requirements of the Gap Analysis Plan that are selected for the audit and/or all the subject areas from the audit subject list SHOULD then be checked. The envisaged audit techniques SHOULD be used for this purpose. If deviations from the documented status of a selected sample are identified, the sample SHOULD be extended as required until the matter is clarified.

During the on-site audit, the IS auditors SHOULD never actively interfere with IT systems or issue any instructions regarding changes to the object of the audit.

All essential issues and details on source, information, and presentation requests, as well as meetings carried out, SHOULD be documented in writing.

In a closing meeting, the IS Audit Team SHOULD briefly present the main findings to the contact persons of the audited organisation. The IS Audit Team SHOULD NOT specifically evaluate the findings, but provide indications of possible deficiencies and explain the next steps. Minutes SHOULD also be taken for this closing meeting.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.46 Loss of Integrity of Sensitive Information