Cybersecurity Risk Management and

Policies
Syllabus
● Introduction to risk management frameworks (NIST, ISO 27001)
● Risk assessment: identification, analysis, evaluation
● Vulnerability assessment and penetration testing basics
● Designing cybersecurity policies and procedures
● Incident response and disaster recovery planning
● Security audits and compliance

1. Introduction to risk management frameworks

Risk management frameworks provide structured methodologies that organizations use to
identify, assess, mitigate, and monitor risks associated with their information systems. These
frameworks ensure that cybersecurity risks are handled in a systematic, repeatable, and measurable
manner. They help security teams evaluate the likelihood and impact of threats, prioritize controls,
and implement safeguards that protect critical assets. By following a recognized framework,
organizations can establish consistent risk management practices that align with business objectives
and regulatory requirements.

A robust risk management framework supports organizations in making informed decisions

about the allocation of security resources. Instead of relying on ad-hoc or reactive practices,
frameworks introduce a disciplined approach that guides security professionals through every step
of the risk lifecycle—from threat identification and vulnerability analysis to control implementation
and continuous monitoring. This ensures that security strategies are not only technically sound but
also cost-effective and aligned with organizational risk tolerance.

Several widely accepted frameworks are used across industries, including NIST Risk
Management Framework (RMF), ISO/IEC 27005, COBIT, and FAIR (Factor Analysis of Information
Risk). Each framework provides a standardized set of processes, terminology, and documentation
templates that help organizations address risks in a consistent manner. While some frameworks
focus on compliance and governance, others emphasize quantitative risk analysis or operational risk
reduction. Choosing the right framework depends on the organization’s industry, regulatory
environment, and maturity level.

1.1 NIST Framework

The NIST Risk Management Framework, developed by the National Institute of Standards
and Technology (NIST), is a comprehensive and structured approach for managing cybersecurity risk
in information systems. It is widely used by government agencies, regulated industries, and
organizations that require strong security governance. The framework integrates security, privacy,
and risk management activities into a unified, repeatable process. It ensures that organizations
identify risks early, implement appropriate controls, and continuously assess system security
throughout the system development life cycle.

The NIST RMF is grounded in the principle that cybersecurity risks must be managed
according to organizational mission objectives and business needs. It provides a flexible process that
can be tailored to different types of systems, operational environments, and compliance
requirements. The framework aligns closely with the NIST Cybersecurity Framework (CSF) and the
NIST SP 800-series, particularly SP 800-37 and SP 800-53, which define security and privacy controls.
By adopting the RMF, organizations benefit from a structured, evidence-based approach to risk
decision-making and authorization.

The Seven Steps of the NIST RMF

1. Prepare
Establish context, assign responsibilities, identify stakeholders, and define system
boundaries. This step ensures that the organization is fully ready to implement the
RMF activities and that all required resources and documentation are in place.
2. Categorize
Classify the information system according to potential impact (low, moderate, high)
based on confidentiality, integrity, and availability. Categorization is performed using
 FIPS 199 and ensures that security controls are applied according to system
criticality.
3. Select
Choose appropriate baseline security and privacy controls from NIST SP 800-53.
Controls may be tailored based on system-specific needs, risk appetite, and
compliance obligations.
4. Implement
Deploy and integrate selected controls into the information system. Organizations
document how each control is implemented, including technical configuration,
operational procedures, and responsible personnel.
5. Assess
Evaluate the effectiveness of controls through testing, validation, and
documentation. An independent assessment verifies whether controls are
functioning as intended and whether risks are acceptable.
6. Authorize
A senior official reviews the assessment results and formally authorizes the system
to operate (ATO). This decision is based on residual risk, compliance posture, and
organizational risk tolerance.
7. Monitor
Continuously track system changes, security events, emerging threats, and control
effectiveness. Monitoring ensures that the system remains secure throughout its
operational life cycle and that risks are managed proactively.

Key Advantages of NIST Framework

 Provides a standardized, repeatable, and legally recognized risk management

process.
 Ensures alignment with strong technical controls from NIST SP 800-53.
 Emphasizes continuous monitoring, improving long-term security posture.
 Highly adaptable across industries, system types, and security maturity levels.
 Enhances accountability through clear documentation and governance processes.

1.2 ISO 27001

ISO/IEC 27001 is an internationally recognized standard for establishing,

implementing, maintaining, and continually improving an Information Security Management
System (ISMS). It provides a systematic approach to managing sensitive information and
ensuring its confidentiality, integrity, and availability. Organizations adopt ISO 27001 to
protect their data assets from cyber threats, reduce security risks, and demonstrate
compliance with industry best practices. The standard is applicable to organizations of any
size or sector and is widely used globally for information security governance.
 ISO 27001 is built on a risk-based approach, meaning that all security controls are
selected and implemented based on the organization’s specific risks. Instead of prescribing
fixed technical requirements, the standard provides a framework for identifying threats,
assessing vulnerabilities, and determining appropriate controls. It aligns with the Plan-Do-
Check-Act (PDCA) cycle (also called the Deming Cycle), ensuring continuous improvement.
This makes ISO 27001 a dynamic and adaptive standard that evolves with the changing
threat landscape.

Key Components of ISO 27001

1. Information Security Management System (ISMS)

A structured set of policies, procedures, processes, and controls that manage
information security risks. The ISMS ensures that all security activities are aligned
with organizational objectives.
2. Risk Assessment and Treatment
ISO 27001 requires organizations to systematically identify risks, assess their impact
and likelihood, and select controls to reduce risks to acceptable levels. The chosen
controls must be documented in a risk treatment plan.
3. Annex A Controls (93 Controls as per ISO 27001:2022)
Annex A provides a list of security controls grouped into four key themes:
o Organizational controls
o People controls
o Physical controls
 o Technological controls
These controls include policies, access management, cryptography, supplier
security, logging, monitoring, incident response, system acquisition, and
more.
4. Leadership and Governance
Top management must be actively involved in defining security objectives, allocating
resources, and promoting a culture of security. Their commitment is essential for
certification.
5. Documentation and Evidence
Required documents include security policies, scope statements, risk registers, SoA
(Statement of Applicability), asset inventory, incident logs, training records, and
internal audit reports.

ISO 27001 Process (PDCA Cycle)

1. Plan
Define ISMS scope, perform risk assessment, identify applicable controls, and create
policies and procedures.
2. Do
Implement risk treatment measures and execute the ISMS processes and controls.
3. Check
Conduct internal audits, performance evaluations, and compliance checks to ensure
effectiveness.
4. Act
Take corrective actions to address gaps, enhance controls, and strengthen the ISMS
for continuous improvement.

Advantages of ISO 27001

 Reduces cybersecurity risks through a structured, risk-based approach.

 Demonstrates compliance with international security standards, improving trust
among stakeholders.
 Enhances organizational governance and accountability.
 Improves incident detection, response, and recovery capabilities.
 Strengthens competitive advantage for businesses dealing with sensitive
information.
 Ensures legal and regulatory compliance (GDPR, RBI guidelines, HIPAA, etc.).

Limitations of ISO 27001

 High implementation and maintenance cost.
 Requires significant time, resources, and skilled personnel.
 Extensive documentation requirements create administrative overhead.
 Not a technical standard; does not prescribe specific security technologies.
 Certification does not guarantee complete protection from cyberattacks.
 Risk of becoming a checklist-based compliance exercise.
 Requires continuous monitoring, audits, and updates to remain effective.
 May not fully meet the needs of highly specialized or regulated industries.
1.3 Comparison of NIST and ISO 27001

Aspect ISO 27001 NIST RMF

International standard for
U.S. government-developed risk
Nature Information Security
management process
Management System (ISMS)
Establishing, implementing, Managing system-level
Focus maintaining, and improving an cybersecurity risk in a structured
ISMS lifecycle
Risk-based, strategic, and policy- Technical, control-focused, and
Approach
driven operational
Global, all industries, all Primarily U.S. federal agencies;
Applicability
organizational sizes widely used in regulated industries
No formal certification;
Offers formal third-party
Certification organizations achieve
certification
“Authorization to Operate (ATO)”
Implementation Moderate to high; depends on High due to extensive control
Complexity organizational size requirements and assessments
Moderate flexibility; baseline
High flexibility; organizations
Flexibility controls must be tailored but still
choose controls based on risk
prescribed
Ensure secure operation of
Establish and maintain effective
Primary Goal information systems throughout
ISMS
lifecycle
Organizations seeking Organizations needing strong
Best Suited For international certification and technical controls and compliance
structured governance with U.S. standards

1.4 Which framework to choose

When to Choose ISO 27001

Choose ISO 27001 if your organization:

 Operates internationally or needs a globally recognized certification.

 Wants a formal, auditable Information Security Management System (ISMS).
 Requires a risk-based, business-oriented approach rather than a technical one.
 Wants to demonstrate security assurance to customers, partners, and auditors.
 Is in commercial sectors such as IT services, manufacturing, healthcare, finance, or
consulting.
 Needs a certification to win contracts or meet customer requirements.
ISO 27001 is best suited for organizations seeking structured governance, continuous
improvement, and global credibility.

When to Choose NIST RMF

Choose NIST RMF if your organization:

 Is a U.S. federal agency or works with U.S. government contracts.

 Needs detailed technical and operational security controls (NIST SP 800-53).
 Operates in highly regulated sectors such as defense, critical infrastructure, energy,
or finance.
 Requires continuous monitoring, system-level authorization, and strong technical
compliance.
 Prioritizes system security engineering and lifecycle-based risk management.

NIST RMF is ideal for organizations that need deep technical rigor, extensive security
controls, and U.S. compliance alignment.

2. Risk Assessment

Risk assessment is a fundamental component of cybersecurity and information

security management. It involves systematically identifying, analyzing, and evaluating risks
that could affect the confidentiality, integrity, and availability of an organization’s
information assets. The primary objective of risk assessment is to understand potential
threats, their likelihood, and the impact they may cause so that organizations can prioritize
and treat risks effectively. By conducting a structured risk assessment, organizations gain
visibility into weaknesses within systems, processes, people, and technologies.

The risk assessment process typically begins with identifying assets such as data,
hardware, software, networks, personnel, and critical operations. Once assets are identified,
potential threats (cyberattacks, human errors, system failures, natural disasters) and
vulnerabilities (software flaws, misconfigurations, inadequate policies) are analyzed. The
organization then evaluates the likelihood of these threats exploiting vulnerabilities and the
possible consequences. This helps determine the overall risk level and guides decision-
making for implementing controls, mitigation actions, and preventive measures.

Risk assessments can be qualitative, quantitative, or a hybrid of both. Qualitative

assessments use descriptive scales (high, medium, low) to define likelihood and impact,
making them easier and faster to perform. Quantitative assessments use numerical values
and statistical models to calculate risk in measurable terms, providing more precise
decision-making data. Many organizations use a combination of both to balance accuracy
and practicality.
 Ultimately, effective risk assessment supports better resource allocation, reduces
security incidents, and aligns cybersecurity decisions with business objectives. It forms the
foundation for risk treatment, risk acceptance, and ongoing monitoring. Regular risk
assessments ensure that the organization adapts to evolving threats, technology changes,
and emerging vulnerabilities, making it a critical component of any risk management
framework.

Steps Involved in Risk Assessment

1. Asset Identification
o Identify and list all critical information assets such as data, hardware,
software, networks, applications, facilities, and personnel.
o Determine asset value based on sensitivity, importance, and impact on
business operations.
2. Threat Identification
o Identify potential threats that could harm the assets.
o Common threats include cyberattacks, malware, insider threats, natural
disasters, hardware failures, and human errors.
3. Vulnerability Identification
o Identify weaknesses or gaps in systems, processes, policies, and technology
that could be exploited by threats.
o Examples include outdated software, poor configurations, weak access
controls, or lack of employee training.
4. Risk Analysis
o Analyze how threats may exploit vulnerabilities and estimate the likelihood of
occurrence and potential impact.
o Risk analysis can be qualitative (high/medium/low) or quantitative (numerical
values, statistical models).
5. Risk Evaluation
o Compare analyzed risks against the organization’s risk tolerance and risk
criteria.
o Prioritize risks based on severity to decide which require immediate
treatment and which can be accepted or monitored.
6. Risk Treatment Planning
o Select appropriate actions to address identified risks.
o Common treatment strategies include risk mitigation, risk avoidance, risk
transfer, and risk acceptance.
7. Documentation and Reporting
o Record risk assessment results in a risk register or report.
o Include identified risks, their severity, controls chosen, and responsibilities
for risk treatment.
8. Review and Continuous Monitoring
o Regularly review and update the risk assessment to reflect new threats,
vulnerabilities, technology changes, and business requirements.
o Continuous monitoring ensures the risk management process remains
effective and relevant.
3. Vulnerability assessment and penetration testing

3.1 Vulnerability assessment

Vulnerability assessment is a systematic process used to identify, analyze, and
document weaknesses in an organization’s information systems, networks, applications, and
security controls. The purpose of this assessment is to uncover security gaps that could be
exploited by cyber attackers or lead to accidental failures. Unlike penetration testing, which
focuses on exploiting vulnerabilities, a vulnerability assessment focuses on finding and
prioritizing them before they can be misused. It forms a critical part of an organization’s
proactive security strategy and helps maintain a strong security posture.

A vulnerability assessment typically involves scanning systems using automated tools

such as vulnerability scanners, configuration analyzers, and patch management systems.
These tools detect outdated software, missing patches, misconfigurations, weak passwords,
open ports, unencrypted data flows, and other potential weaknesses. Once identified,
vulnerabilities are classified based on severity using standard frameworks such as CVSS
(Common Vulnerability Scoring System). This helps security teams prioritize remediation
actions and allocate resources effectively.

The assessment process includes four major stages: identifying assets, scanning for
vulnerabilities, analyzing and validating findings, and generating a detailed report. The
report highlights critical vulnerabilities, their potential impact, and recommended mitigation
measures. These measures may include applying patches, updating configurations,
strengthening access controls, or removing unnecessary services. Regular vulnerability
assessments ensure that systems stay updated and resilient against evolving threats.

Overall, vulnerability assessment is essential for reducing the attack surface, improving
compliance with standards, and supporting continuous risk management. By identifying
weaknesses early, organizations can prevent exploitation, reduce the likelihood of security
incidents, and maintain a secure operating environment.

3.2 Penetration Testing

Penetration testing is a controlled and authorized security exercise in which skilled

testers (ethical hackers) simulate real-world cyberattacks to identify exploitable weaknesses
in an organization’s systems, networks, applications, or infrastructure. The purpose of
penetration testing is not only to detect vulnerabilities but also to actively exploit them in a
safe manner to determine the actual level of risk they pose. This provides a realistic
assessment of how attackers might gain unauthorized access, escalate privileges, disrupt
operations, or steal sensitive information. Penetration testing helps organizations validate
their security controls, strengthen their defenses, and understand the practical impact of
security gaps.

Penetration testing is performed using a combination of manual techniques and

specialized tools. Testers follow a structured methodology that includes reconnaissance,
threat modeling, vulnerability exploitation, privilege escalation, and reporting. Depending
on the engagement type, penetration testing can be conducted with different knowledge
levels: black-box (no prior information), white-box (full information), or grey-box (partial
information). This allows organizations to evaluate security from multiple perspectives,
including that of an external attacker, a malicious insider, or a privileged user.

Penetration testing typically focuses on areas such as network security, web and
mobile applications, wireless networks, cloud environments, endpoint systems, and social
engineering. After testing, a comprehensive report is prepared that includes exploited
vulnerabilities, attack paths, business impact, and recommendations for remediation. This
report helps security teams prioritize fixes and implement effective mitigation strategies.

Overall, penetration testing is an essential part of a mature cybersecurity program. It

provides valuable insights into how well an organization can withstand actual cyberattacks,
supports regulatory compliance, and drives continuous improvement of security controls. By
testing defenses under realistic conditions, organizations can proactively reduce risk and
enhance their overall security resilience.
Steps Involved in Penetration Testing

1. Planning and Reconnaissance

This is the initial and foundational phase where the scope, objectives, and rules of
engagement are defined. Security professionals identify the systems, networks, or
applications to be tested and determine testing constraints, timelines, and communication
protocols. During reconnaissance, testers gather intelligence about the target environment
using passive and active information-gathering techniques. This includes domain
information, network architecture, publicly available data, and any potential entry points.

2. Scanning and Enumeration

In this stage, penetration testers analyze the target systems to understand how they
respond to different intrusion attempts. Automated tools and manual techniques are used
to scan for open ports, active hosts, running services, software versions, and vulnerabilities.
Enumeration provides more granular details such as user accounts, network shares,
configurations, and exposed APIs. The outcome of this phase helps testers identify
vulnerabilities and plan exploitation strategies.

3. Gaining Access (Exploitation)

Testers attempt to exploit the identified vulnerabilities using controlled and safe attack
techniques. This may involve SQL injection, buffer overflows, cross-site scripting, privilege
escalation, or exploiting weak authentication mechanisms. The goal is to assess whether
unauthorized access can be obtained and how deep the compromise can go. Testers
measure the impact of exploitation and determine whether sensitive data or critical systems
can be accessed.

4. Maintaining Access (Post-Exploitation)

After successfully gaining entry, testers focus on determining how long an attacker could
persist within the environment without detection. They attempt to escalate privileges, pivot
across the network, or install backdoors to simulate real-world persistence techniques. This
step helps evaluate the organization’s ability to detect and respond to sustained attacks and
identifies weaknesses in monitoring and incident detection.

5. Analysis and Reporting

All findings, including exploited vulnerabilities, techniques used, impacted systems, and
severity ratings, are compiled into a detailed report. The report typically includes risk
assessments, supporting evidence, screenshots, and recommendations for remediation. The
objective is to provide actionable insights that help the organization strengthen its security
posture. Reports are shared with management and technical teams for further corrective
action.
6. Remediation and Retesting

The organization addresses the vulnerabilities identified during the test by applying patches,
improving configurations, or updating security policies. Once remediation is completed,
testers conduct a retest to confirm that the issues have been resolved and no new gaps
have been introduced. This step ensures that corrective actions are effective and
sustainable.

4. Designing Cybersecurity Policies and Procedures

Designing cybersecurity policies and procedures involves establishing formal rules,

guidelines, and operational instructions that define how an organization protects its
information assets. These policies act as a strategic blueprint that aligns security objectives
with business goals, regulatory requirements, and industry standards. A well-designed
cybersecurity policy outlines expectations for employees, outlines acceptable behaviors,
and sets the foundation for consistent and compliant security practices. It ensures that
everyone within the organization understands their security responsibilities and the
consequences of non-compliance.

An effective cybersecurity policy must be clear, enforceable, and aligned with applicable
legal and regulatory frameworks such as GDPR, HIPAA, or ISO 27001. Policies should be
reviewed by multiple stakeholders, including IT, legal, HR, and executive management, to
ensure organizational alignment. After approval, policies must be communicated through
training programs and integrated into daily operations. Awareness campaigns, mandatory
training sessions, and periodic drills help employees understand how to comply with the
policies in practice.

Stepwise Procedure for Designing Cybersecurity Policies and Procedures

 Identify and classify assets.
 Assess risks and security requirements.
 Review legal and compliance needs.
 Define policy objectives and scope.
 Draft high-level policies.
 Write supporting procedures.
 Review and approve with stakeholders.
 Communicate and train users.
 Implement controls.
 Monitor compliance and update policies periodically.
5. Incident Response and Disaster Recovery Planning
Incident Response (IR) is the structured approach that organizations follow to detect,
analyze, and respond to cybersecurity incidents such as data breaches, malware infections,
or insider attacks. The primary goal of IR is to minimize damage, contain the threat, restore
normal operations quickly, and prevent recurrence. A formal Incident Response Plan (IRP)
defines roles and responsibilities, reporting mechanisms, communication channels, and
step-by-step procedures for handling incidents. Key phases of IR typically include
preparation, identification, containment, eradication, recovery, and lessons learned.

Disaster Recovery (DR) Planning focuses on ensuring business continuity and the rapid
restoration of critical systems and data following catastrophic events, whether cyberattacks,
natural disasters, or system failures. Disaster Recovery Plans (DRPs) define recovery
objectives, backup strategies, alternate site arrangements, and recovery procedures. DR is
closely tied to business continuity planning, as it ensures that essential operations continue
or resume with minimal downtime and data loss. Effective DR planning involves regular
testing, validation of recovery procedures, and updates to address evolving threats and
infrastructure changes.

Together, Incident Response and Disaster Recovery form a comprehensive approach to

organizational resilience. While IR addresses the immediate containment and mitigation of
security events, DR ensures long-term recovery and continuity of operations. Regular
training, table top exercises, and simulations help ensure that both IR and DR plans are
actionable, effective, and understood by all stakeholders. By integrating IR and DR planning,
organizations can reduce the impact of incidents, comply with regulations, and maintain
stakeholder confidence.

5.1 Incident Response

Incident Response (IR) is a systematic approach used by organizations to detect,
analyze, and respond to cybersecurity incidents. These incidents can include data breaches,
malware attacks, ransomware, phishing, insider threats, denial-of-service attacks, or any
event that disrupts normal operations or compromises information security. The main goal
of IR is to minimize damage, reduce downtime, restore operations quickly, and prevent
future occurrences.

Objectives of Incident Response

 Rapid detection and containment of security incidents.

 Minimization of operational, financial, and reputational impact.
 Collection and preservation of forensic evidence.
  Restoration of affected systems and services.
 Compliance with regulatory and legal requirements.
 Continuous improvement of security measures through lessons learned.

Phases of Incident Response

1. Preparation
o Establish an Incident Response Team (IRT) with defined roles.
o Develop and maintain an Incident Response Plan (IRP).
o Conduct employee training and awareness.
o Deploy necessary tools such as intrusion detection systems, SIEM, and
forensic tools.
2. Identification
o Detect potential security events using monitoring, alerts, and logs.
o Determine whether an event qualifies as a security incident.
o Assess scope, type, and severity of the incident.
3. Containment
o Short-term containment: isolate affected systems to prevent spread.
o Long-term containment: implement temporary fixes while preparing full
remediation.
o Prevent further damage without disrupting business unnecessarily.
4. Eradication
o Identify the root cause of the incident.
o Remove malware, vulnerabilities, unauthorized access, or misconfigurations.
o Apply patches, update systems, and strengthen defenses.
5. Recovery
o Restore systems and data to normal operation.
o Monitor systems to ensure no residual threats remain.
o Validate that business processes are fully functional.
6. Lessons Learned
o Conduct post-incident analysis and review.
o Document findings, including what went wrong and what worked well.
o Update IR policies, procedures, and security controls to prevent recurrence.

Advantages of Incident Response

 Reduces damage and operational downtime.

 Enhances security posture through proactive detection.
 Helps maintain regulatory compliance.
 Protects organizational reputation and stakeholder trust.
 Provides structured guidance for managing complex incidents.
Limitations

 Requires skilled personnel and continuous training.

 Can be resource-intensive for small organizations.
 Effectiveness depends on preparation and timely detection.
 May not prevent all incidents, especially zero-day attacks.

5.2 Disaster Recovery Planning

Disaster Recovery Planning is the process of preparing for and recovering from
disruptive events that affect IT systems, networks, applications, or data. These events may
include cyberattacks, hardware failures, natural disasters, power outages, or human errors.
DRP ensures business continuity, minimizing downtime and data loss while restoring normal
operations as quickly as possible.

Disaster Recovery Planning (DRP) complements incident response by ensuring

business continuity during catastrophic events, including cyberattacks, natural disasters, or
system failures. DRP focuses on restoring critical IT systems, applications, and data within
defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Key
components of DRP include risk assessment, business impact analysis, backup strategies,
disaster recovery sites (hot, warm, or cold), communication plans, and regular testing to
validate the effectiveness of recovery procedures. DRP helps minimize operational and
financial impact and maintain stakeholder trust.

Together, Incident Response and Disaster Recovery form a comprehensive approach

to organizational resilience. IR addresses immediate threats and limits damage, while DR
ensures long-term continuity and rapid restoration of essential services. Regular training,
simulations, and audits ensure both IR and DR plans are actionable and effective. By
integrating these processes, organizations can reduce downtime, comply with regulations,
strengthen cybersecurity posture, and maintain confidence among customers, employees,
and stakeholders.

Here are the steps in Disaster Recovery Planning (DRP) in concise bullet points:

 Conduct risk assessment and business impact analysis (BIA).

 Identify critical systems, applications, and data.
 Define Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
 Develop recovery strategies (backups, redundancy, failover sites).
 Create a detailed disaster recovery plan with roles, procedures, and communication
protocols.
 Implement DR infrastructure and controls (backup systems, replication, access
controls).
 Test and validate the plan through drills or simulations.
 Maintain and update the DRP regularly to address changes and emerging threats.
6. Security Audits and Compliance

Security audits are checks done to see if an organization’s systems, policies, and
processes are secure and working correctly. The main goal is to find weaknesses, make sure
security rules are being followed, and suggest ways to improve. Audits can be done
internally by the organization’s own team or externally by independent auditors or
regulators. Compliance means following laws, rules, and standards related to information
security. Examples include GDPR, HIPAA, PCI-DSS, SOX, and ISO 27001. Being compliant
helps organizations protect data, avoid legal penalties, and maintain customer trust.
Security audits help measure compliance and show areas that need fixing.

A security audit usually includes planning, collecting information, checking controls, testing
for vulnerabilities, and writing a report. Auditors check system settings, access permissions,
policies, logs, and processes. The report shows which areas meet standards, which need
improvement, and recommended actions. Regular audits and compliance checks help
organizations improve security, reduce the risk of attacks, and gain the trust of customers
and partners. They also guide organizations to fix weak points and follow best practices.
Overall, audits and compliance help keep information safe and the organization prepared
for any security issues.

Steps in Security Audits and Compliance

 Step 1: Planning and Scope

o Define what systems, processes, and areas will be audited.
o Set objectives and determine compliance standards to check.
 Step 2: Information Gathering
o Collect data on systems, network configurations, access controls, policies,
and logs.
 Step 3: Evaluation of Controls
o Review security policies, procedures, and technical controls.
o Check if they meet regulatory and organizational requirements.
 Step 4: Testing and Verification
o Test systems for vulnerabilities, misconfigurations, or policy violations.
o Verify whether controls are working effectively.
 Step 5: Reporting
o Prepare a detailed report showing compliance status, gaps, risks, and
recommendations.
o Highlight critical areas needing immediate attention.
 Step 6: Remediation and Follow-up
o Fix identified issues based on audit findings.
o Conduct follow-up checks to ensure corrective actions are effective.
 Step 7: Continuous Monitoring
o Regularly review systems and processes to maintain compliance and improve
security.