+DER.3.2.A14 Selection of Target Objects and Requirements to Be Audited [IS Audit Team] (S)

DER.3.2.A14 Selection of Target Objects and Requirements to Be Audited [IS Audit Team] (S)

Within the framework of an IS cross-sectional audit or an IS partial audit, the IS Audit Team SHOULD select the module target objects for the on-site audit based on the results of the checks of documents. However, the information security management module (see ISMS.1 Security Management)) of the IT-Grundschutz Compendium, including all its related requirements, SHOULD always be checked completely. A further 30 per cent of the remaining module target objects SHOULD be selected for auditing in a risk-based approach. The selection SHOULD be documented in a transparent manner. For the module target objects selected in this way, 30 per cent of the respective requirements SHOULD be checked during the IS audit.

In addition, the requirements for which shortcomings have been found in previous IS audits SHOULD be taken into account when selecting the module target objects to be audited. All requirements for which serious security shortcomings have been ascertained in previous IS audits SHOULD be audited.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.29 Violations of Laws or Regulations