DER.3.2 Audits Based on the BSI “Guideline for IS Audits”

An organisation MUST designate a person in charge of IS auditing. This person MUST plan and initiate IS audits and track their results.

The person in charge of an IS audit MUST create an IS audit manual that contains the objectives, legal requirements, and information about the organisation, its resources, and the framework conditions at hand. It MUST also describe how to archive the related documentation. The manual MUST be approved by the Top Management.

An IS audit MUST be carried out based on BSI Standards 200-1 to 200-3 and the IT-Grundschutz Compendium. The IT-Grundschutz Standard Protection SHOULD be used for this. These audit principles MUST be known to all the parties involved.

If an organisation is not certified in line with ISO 27001 on the basis of IT-Grundschutz, the person in charge of its IS audit and the organisation's Top Management MUST ensure that an IS partial audit or IS cross-cutting audit is carried out at least every three years. In addition, further audits should be planned if the information domain in question is significantly changed.

The person in charge of the IS audit should draw up a rough multi-year plan for audits. This schedule SHOULD then be made more specific in a detailed one-year schedule.

A team consisting of at least two IS auditors MUST be assembled or commissioned. The IS Audit Team MUST be granted unlimited information and inspection rights for its activities. In internal IS Audit Teams, the individual IS auditors MUST be impartial. The members of an IS Audit Team MUST NOT be or have been involved in planning or implementing the ISMS in question.

An IS Audit Team MUST be commissioned to conduct an IS audit. The IS Audit Team MUST determine the reference documents required for the IS audit. The organisation to be audited MUST hand over its security concept and all other necessary documents to the IS Audit Team.

Within the framework of an IS audit, the IS Audit Team MUST perform a document audit and an on-site audit. All the results of the two audits MUST be documented in writing and summarised in an IS audit report.

Before performing an IS cross-cutting audit for the first time, the person in charge of the IS audit MUST select an IS partial audit as the IS audit procedure. The IS partial audit MUST be completed with a positive result before an IS cross-cutting audit is performed.

The organisation in question MUST securely store the IS audit report and the reference documents the report is based on for at least 10 years after it is produced, unless different laws or regulations apply. The organisation MUST ensure that only authorised persons may access the IS audit reports and reference documents.

The Chief Information Security Officer SHOULD ensure that IS audits based on IT-Grundschutz form part of their organisation's security process. Furthermore, the results of IS audits SHOULD be incorporated back into the improvement of the ISMS at hand.

In addition, the results of IS audits and activities to remedy deficiencies and improve quality SHOULD be included in the CISO's regular report to the organisation's Top Management.

There SHOULD be clear rules on how information is to be exchanged between the IS Audit Team and the organisation to be audited. This SHOULD ensure that the confidentiality and integrity of this information remains intact.

When an IS cross-cutting audit is to be conducted, an initial meeting SHOULD take place between the IS Audit Team and the contact persons within the organisation to be audited. The meeting SHOULD include the following items:

• explanation and presentation of the IS audit process
• presentation of the organisation to be audited (focus of work and overview of the IT used)
• handover of the reference documents to the IS Audit Team

Prior to an IS audit, the IS Audit Team SHOULD create a Gap Analysis Plan. If it is necessary to extend or otherwise adapt the planned procedures during the audit, the Gap Analysis Plan SHOULD be adapted accordingly. The Gap Analysis Plan SHOULD also be included in the final IS audit report.

During an IS partial audit, the binding audit subject list from BSI SHOULD be used as the Gap Analysis Plan.

The IS Audit Team SHOULD check the requirements defined in the Gap Analysis Plan during its document check. The IS Audit Team SHOULD check whether all the relevant documents are up to date and complete. When checking whether documents are up to date, their granularity SHOULD be taken into consideration. Care SHOULD be taken to ensure that all the relevant aspects are included and appropriate roles are assigned.

Furthermore, the transparency of the documents and the decisions they contain SHOULD be checked. To the extent that doing so makes sense, the results of the document review SHOULD be documented and incorporated into the on-site audit.

Within the framework of an IS cross-sectional audit or an IS partial audit, the IS Audit Team SHOULD select the module target objects for the on-site audit based on the results of the checks of documents. However, the information security management module (see ISMS.1 Security Management)) of the IT-Grundschutz Compendium, including all its related requirements, SHOULD always be checked completely. A further 30 per cent of the remaining module target objects SHOULD be selected for auditing in a risk-based approach. The selection SHOULD be documented in a transparent manner. For the module target objects selected in this way, 30 per cent of the respective requirements SHOULD be checked during the IS audit.

In addition, the requirements for which shortcomings have been found in previous IS audits SHOULD be taken into account when selecting the module target objects to be audited. All requirements for which serious security shortcomings have been ascertained in previous IS audits SHOULD be audited.

The IS Audit Team SHOULD ensure that appropriate audit techniques are used to determine the areas to be audited. All audits SHOULD be proportionate.

Together with the contact person of the organisation to be audited, the IS Audit Team SHOULD draw up a schedule for the on-site audit. The results SHOULD be documented along with the IS Gap Analysis Plan.

The IS Audit Team SHOULD investigate and determine whether the selected measures for the on-site audit meet the requirements of IT-Grundschutz in a practical and adequate manner.

The audit SHOULD start with an initial meeting. All the requirements of the Gap Analysis Plan that are selected for the audit and/or all the subject areas from the audit subject list SHOULD then be checked. The envisaged audit techniques SHOULD be used for this purpose. If deviations from the documented status of a selected sample are identified, the sample SHOULD be extended as required until the matter is clarified.

During the on-site audit, the IS auditors SHOULD never actively interfere with IT systems or issue any instructions regarding changes to the object of the audit.

All essential issues and details on source, information, and presentation requests, as well as meetings carried out, SHOULD be documented in writing.

In a closing meeting, the IS Audit Team SHOULD briefly present the main findings to the contact persons of the audited organisation. The IS Audit Team SHOULD NOT specifically evaluate the findings, but provide indications of possible deficiencies and explain the next steps. Minutes SHOULD also be taken for this closing meeting.

Interviews conducted by the IS Audit Team SHOULD be structured. Questions SHOULD be concise, precise, and easy to understand. In addition, appropriate interviewing techniques SHOULD be used.

The IS Audit Team SHOULD check whether the remaining residual risks are appropriate and acceptable for the information domain at hand and whether the Top Management has officially acknowledged its acceptance of them in a binding manner. The IS Audit Team SHOULD randomly verify whether and to what extent the options selected to treat risks have been implemented.

After the on-site audit, the information collected by the IS Audit Team SHOULD be further consolidated and analysed. After any additional information and documentation requested after the fact have been assessed, the audited requirements SHOULD be subject to a final evaluation.

The IS Audit Team SHOULD transfer the results obtained into an IS audit report and document them transparently. A draft version of the report SHOULD be sent in advance to the audited organisation. It SHOULD be verified whether the issues established by the IS Audit Team were correctly recorded.

The audited organisation SHOULD ensure that all affected entities within the organisation are provided with the sections of the IS audit report that are important and necessary for them within an appropriate time frame. In particular, the contents SHOULD be communicated to the Top Management, the person in charge of the IS audit, and the CISO.

IS audit reports SHOULD be assigned an appropriate confidentiality rating based on the sensitive information they contain.

The possibility of having the IS Audit Team provide the results of the IS audit to the Top Management in the form of a presentation SHOULD be considered.

The deviations identified in the IS audit report SHOULD be corrected by the CISO within a reasonable period of time. The corrective measures to be performed SHOULD be documented along with the respective responsibilities, dates of implementation, and status. The implementation SHOULD be followed up on continuously and the implementation status updated.

The necessity of additional IS audits SHOULD be checked as a matter of principle. The person in charge of the IS audit SHOULD adapt both the rough and detailed plans for the IS audit.