ISO/IEC 27001 control areas
Audit criteria for agreed information security management and control topics; not certification.
IT audits
IT Security Audits
A scoped audit compares documented and operating controls with agreed criteria. It identifies gaps and improvement priorities but does not itself grant certification.
Assessment scope
What is tested
The final test coverage is agreed during scoping and limited to systems for which written authorization has been provided.
Security governance and asset ownership
Identity and access management
Secure configuration and change control
Vulnerability and patch management
Logging, monitoring, backup, and recovery
Supplier, incident, and continuity processes
Engagement flow
Controlled from authorization to retest.
01
Scope & authorization
Define objectives, approved systems, constraints, test windows, contacts, and rules of engagement.
02
Discovery
Establish the authorized attack surface, architecture, user roles, assets, and applicable assessment criteria.
03
Controlled testing
Assess the approved scope using manual and technical methods appropriate to the environment.
04
Validation
Confirm findings safely, remove false positives, and establish practical technical and business impact.
05
Reporting
Receive findings supported by evidence, risk ratings, an executive summary, and remediation priorities.
06
Remediation review
Review proposed corrective actions and clarify implementation priorities with the assessment team.
07
Retest
Verify agreed fixes and record whether each tested finding has been resolved, reduced, or remains open.
Assessment references
Industry standards and guidance
CIS Controls
Prioritized safeguards and evidence review across technical and operational controls.
NIST Cybersecurity Framework
Risk and capability context across Govern, Identify, Protect, Detect, Respond, and Recover.
CIS Benchmarks
Configuration criteria for selected systems where included in scope.
Standards guide scope and test coverage. An assessment does not itself constitute certification or guarantee compliance.
Reporting
What you receive
Audit scope and criteria statement
Observations supported by evidence
Register of control gaps and risks
Prioritized improvement plan
Management briefing and subsequent review
Define an appropriate test scope.
Discuss the systems, objectives, access level, and required evidence with DIGITPOL.