Question

Question: “AUDIT OF A FACILITY'S/SITE'S IT SECURITY”

1. List 5 overall audit goals for this audit

2. Describe the scope of the audit i.e. how big, broad, and deep the audit will be in terms of topics to be audited.

3. List 5 Critical success factors that you consider essential for the security to be considered “effective/successful” at this facility.

4. List 5 “things that could go wrong” with the security.

5. List 5 “Key performance indicators (KPI’s) that will help guide you in determining how well the application system is being effective/successful.

6. For the specific part of the audit that deals with “Off-premise backup and recovery of data”, list 5 specific audit program steps that you will do to accomplish your audit.

Answer 1

1. Goals of audit:
   1. To provide an assessment of current IT security systems.
   2. To evaluate how well the client services are being used.
   3. To re-evaluate the integrity of security systems.
   4. To update the security patches.
   5. To identify potential areas of improvement
2. Scope of audit:
   1. The audit will be done with the systems of entire site.
   2. IT security services implemented in the past fiscal year will be taken under consideration.
3. Critical success factors:
   1. All systems must be free from any malware, PUPs, viruses, etc.
   2. All systems must be password protected and these passwords must be changed every 4 weeks.
   3. The IT security architecture should be well defined and have a structured build.
   4. Personal data must be secured.
   5. Access to emails should be highly secure and spam mails must be filtered.
4. Things that could go wrong:
   1. Entry to malware, PUPs, viruses, etc.
   2. Leakage of sensitive information.
   3. No/weak password protections to systems.
   4. IT security architecture not well defined.
   5. Weak mail security.
5. Key performance indicators:
   1. Number of reported security breach incidents.
   2. Number of implemented breach preventive measures.
   3. Number of improvement plans implemented.
   4. Number of security tests.
   5. Amount of time taken to resolve a security issue.