Security & privacy

Security Audit

Also called: Controls Audit

The short version

A security audit checks whether an organisation meets specific security requirements and can show that its safeguards work.

Check the rules and the proof

An auditor might check whether access to sensitive information is reviewed and whether backups are tested. They look at records and speak with staff to see if the organisation does what its policies, contracts, or laws require.

Different from a penetration test

An audit checks that safeguards are in place and used. A penetration test tries to find ways into a system. Passing an audit does not mean the system has no security weaknesses.