IT Audit Checklist Sachin Hissaria 1691968387
IT Audit Checklist Sachin Hissaria 1691968387
IT AUDIT CHECKLIST
Domain
Security Policy
Organizational Security
Asset Management
Human Resource Security
Physical and Environmental Security
Communications and Operations Management
Access Control
Information Systems Acquisition, Development, and
Maintenance
Information Security Incident Management
Business Continuity Management
Compliance
SACHIN HISSARIA
CA | CISA | DISA | CEH | COBIT-19 | ISO27001:2022 | RPA
SACHIN HISSARIA
SACHIN HISSARIA
Security Policy Does the policy include definitions of information security responsibilities?
Documentation
Is there a regular review and update process for the security policy?
Is there a defined consequence for non-compliance with the policy?
Are policies in line with business needs, relevant laws, and regulations?
Does the policy cover all necessary aspects of information security?
Is the policy reviewed at planned intervals?
Is the policy updated based on the results of audits, changes in business
requirements, or changes in legal regulations?
Are revisions to the policy documented?
Are changes to the policy communicated in a timely manner to all relevant
parties?
Security Security Policy
Is there a formal process for individuals to suggest improvements to the
Policy Review
policy?
Are there measures in place to ensure continued policy effectiveness?
Are changes in technology considered during policy reviews?
Is there an appropriate response to significant security incidents that might
lead to a policy review?
Is the policy implemented throughout the organization?
Are employees trained on the details of the policy and their individual
responsibilities?
Is policy compliance monitored and enforced?
Is there an ongoing awareness campaign to keep the policy top-of-mind for
Security Policy
employees?
Implementation
Are resources allocated to facilitate policy implementation?
Are controls and processes aligned with policy requirements?
Are exceptions to the policy managed and approved through a formal
process?
Is there a measure of the effectiveness of the policy implementation?
Are the roles and responsibilities for information security defined within the
organization?
Are these roles and responsibilities communicated to the relevant personnel?
Are they included in job descriptions or contracts?
Is there a designated person or group in charge of information security
Internal Roles
management?
and
Are there clear reporting lines for security incidents or concerns?
Responsibilities
Are segregation of duties principles applied to reduce the risk of unauthorized
activities?
Is there a process for reviewing and updating roles and responsibilities?
Is the effectiveness of the roles and responsibilities implementation
assessed?
Are information security requirements defined and communicated to external
parties such as suppliers and contractors?
Are these requirements reflected in contracts and agreements?
Is there a procedure for managing changes in relationships with external
Organizatio
parties?
nal External Roles
Are there mechanisms for monitoring external parties' compliance with
Security and
security requirements?
Responsibilities
Are the consequences of non-compliance stated in contracts?
Are there regular security audits or reviews for third-party vendors?
Is there a procedure for terminating access to information assets when an
external relationship ends?
Are there measures in place to assess third-party risk?
Is there a security awareness program for all employees?
Is the program tailored to different roles within the organization?
Is there a process to evaluate the effectiveness of the program?
Are there regular updates or refresher courses available?
Are new employees given security awareness training as part of their
Security
onboarding process?
Awareness and
Training Are there clear instructions on what to do in the event of a security incident?
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
Human
Resource
Security
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
SACHIN HISSARIA
Monitoring Are the clocks of all relevant information processing systems synchronized?
System Access
Are there measures to collect and store evidence to support event analysis
and Use
and legal action?
Are event logging and the protection of log information minimally compliant
with legal requirements?
Are procedures in place to link all access to systems and procedures with
individual users?
Are procedures in place to respond rapidly to anomalies?
Is there an information security requirements analysis and specification
process in place for all systems?
Is there a process for ensuring that all information processing systems meet
the organization’s information security requirements?
Is there a process for defining and implementing controls to ensure the
accuracy and completeness of information outputs?
Security Are there regular checks to verify whether the security requirements of
Requirements of installed systems are being met?
Information Is there a regular review of the organization's business processes,
Systems information flows, and systems?
Are there processes in place to identify and assess risks to systems?
Is there a process in place to ensure that changes in the business and
external environment are reflected in the systems’ security requirements?
Are there procedures in place for the secure development and testing of
systems?
Are there controls to ensure correct processing in applications?
Are there procedures in place for detecting and correcting errors in
processing?
Are there procedures in place for ensuring data integrity during processing?
Are there controls in place to prevent or detect the unauthorized manipulation
Correct
of software?
Processing in
Is there a process for ensuring that transaction errors are detected and
Applications
handled appropriately?
Are there checks in place to verify the completeness and accuracy of
processing?
Are there controls in place to ensure the authenticity and integrity of inputs
and outputs?
Is there a rollback procedure for handling processing errors?
Is there a policy on the use of cryptographic controls?
Are cryptographic keys securely managed?
Are cryptographic controls used in compliance with all relevant agreements,
legislation, and regulations?
Are cryptographic controls regularly reviewed and updated?
Cryptographic Is encryption used for the transmission of sensitive data over public
Information Controls networks?
Systems Are there procedures in place for the use of digital signatures?
Acquisition
,
Developme SACHIN HISSARIA
nt, and
Maintenanc
e
SACHIN HISSARIA
Cryptographic
Assessmen Assessment Sub-
Information Controls Assessment Items Status Findings
t Category Category
Systems
Acquisition Is the integrity of sensitive or critical information ensured using cryptographic
, techniques?
Developme Are there controls in place to protect sensitive data in storage using
nt, and cryptographic techniques?
Maintenanc Are there controls in place to secure system files?
e Is there access control in place to protect system files?
Are there controls to ensure the integrity of system files?
Is there a process for the secure development and testing of system files?
Is there a process in place to restrict the installation of software on
Security of
operational systems?
System Files
Are there controls in place to manage system changes and upgrades?
Are system files regularly checked for malware and unauthorized changes?
Are there procedures in place for the secure disposal or reuse of storage
media?
Are there secure development policies in place?
Is there a formal change control process?
Are there technical reviews of applications after operating system changes?
Security in Are there restrictions on changes to software packages?
Development and Are there controls on information leakage from system development
Support Process environments to operational environments?
Are there controls to ensure the separation of duties between developers and
operational staff?
Is there a secure system engineering methodology in place?
Is there a formal process in place for system acceptance?
Are there procedures for timely information collection about technical
vulnerabilities?
Are the organization's exposure to such vulnerabilities evaluated?
Is there a process for timely remediation of the identified vulnerabilities?
SACHIN HISSARIA
SACHIN HISSARIA
Are there regular checks to ensure the use of correctly licensed software?
Are information systems checked for compliance with security
implementation standards?
Technical
Are there regular vulnerability assessments or penetration tests of systems
Compliance
and networks?
Checking
Is there a process in place for addressing non-compliance and vulnerabilities
found during technical compliance checks?
Are there checks on systems to ensure that software patches are up to date?
Are there checks on systems to detect the presence of unauthorized
software?
SACHIN HISSARIA