How do I scope a cybersecurity internal audit engagement?

Question

AcadiFi · Accepted Answer

Use the NIST Cybersecurity Framework as your scoping scaffold. The framework has five functions: Identify, Protect, Detect, Respond, Recover. Pick the ones most relevant to your organization's current risk and recent events.

```mermaid
flowchart TD
  A["Cybersecurity audit request"] --> B["Discuss with risk team and CISO"]
  B --> C["Recent incidents or near-misses?"]
  B --> D["Major changes (cloud, M&A, new product)?"]
  B --> E["Open external audit or regulator items?"]
  C --> F["Focus on Detect and Respond"]
  D --> G["Focus on Identify (new asset inventory) and Protect"]
  E --> H["Focus on the function tied to the open item"]
```

In practice you rarely have time to deep-dive all five functions in one engagement. Pick one or two:

- If the organization recently moved to the cloud: Identify and Protect.
- If there was a recent incident or near-miss: Detect, Respond, and Recover.
- If the audit committee wants a baseline opinion: Identify and Protect first, with light coverage of the other three.

Once you pick the functions, define control objectives within each. For Protect, that might be "privileged access is granted on a least-privilege basis with documented approvals and quarterly reviews." Then map each objective to evidence sources. The audit plan now has structure and the report can conclude function by function rather than producing a generic checklist.

How do I scope a cybersecurity internal audit engagement?

Master Part 2 with our CIA Course

Related Questions

Related Articles

Practice Questions