A Practical Guide to Information Security Audits

A security audit is the systematic process through which an organization evaluates whether its security controls are adequate, properly implemented, and functioning effectively. In an increasingly demanding regulatory environment where frameworks such as the ENS, ISO 27001, NIS2, and DORA impose specific verification requirements, the ability to perform and pass security audits has become a critical organizational competency. This guide covers the types of audits, their phases, evidence management, and how to automate the process to reduce effort and improve outcomes.

What is an information security audit?

An information security audit is an independent, documented evaluation of an organization’s security controls, policies, procedures, and systems. Its goal is to determine the extent to which these elements comply with established requirements (regulatory, contractual, or internal) and whether they are effective at protecting information assets.

Unlike a vulnerability assessment or penetration test, which focus on identifying specific technical weaknesses, an audit encompasses the technical, organizational, procedural, and human aspects of security. An audit evaluates whether an access management policy exists, whether it has been approved by management, whether it is communicated to staff, whether it is technically implemented, whether compliance is monitored, and whether it is periodically reviewed.

The value of an audit lies in its independent and systematic nature. The auditor applies predefined criteria (controls from a standard, requirements from a regulation) and collects objective evidence that supports their conclusions. This evidence-based approach provides confidence to management, regulators, and other stakeholders about the actual state of security.

Bodies such as the CCN-CERT have published specific guides for ENS conformity audits (CCN-STIC guides), and INCIBE provides resources for SMEs to assess their security level independently.

What types of security audits exist?

Security audits are classified by their origin, objective, and technical scope.

Internal audit

Conducted by the organization’s own staff or by consultants hired to act on behalf of the organization. Its objective is to evaluate compliance with internal policies and applicable regulatory requirements, identify areas for improvement, and prepare the organization for external audits.

ISO 27001 requires planned internal audits as part of the ISMS continuous improvement cycle. The ENS also requires periodic internal audits to verify compliance with its requirements.

The main advantage of internal audits is the deep knowledge of the environment that internal auditors possess. The main challenge is maintaining independence: the internal auditor should not audit processes or systems in which they are directly involved.

External audit

Conducted by an independent entity (certification body, accredited audit firm). External audits provide an objective assessment and are required for obtaining certifications such as ISO 27001 or ENS conformity for medium and high categories.

ISO 27001 certification audits are performed by bodies accredited by ENAC (Spain’s National Accreditation Entity). ENS conformity audits are conducted by public sector entities or by the CCN itself for government agencies.

Compliance audit

Specifically focused on verifying compliance with legal and regulatory requirements. A GDPR compliance audit would assess whether the organization complies with data protection principles, whether it has appointed a DPO when required, whether it maintains a record of processing activities, and whether it has conducted impact assessments where applicable.

NIS2 and DORA compliance audits, although these regulations are relatively recent, are already generating demand for specialized professionals and methodologies.

Technical audit

Focuses on evaluating technical controls: firewall configuration, server security, patch management, web application security, encryption, and identity and access management. It frequently includes penetration testing, vulnerability analysis, and configuration reviews.

The CCN’s CCN-STIC guides provide security profiles for configuring numerous technology platforms that serve as benchmark criteria in technical audits of public bodies.

What are the phases of a security audit?

The audit process follows a structured sequence that ensures thoroughness and quality of results.

Phase 1: Planning

Planning is the most critical and frequently the most underestimated phase. Good planning determines the effectiveness of the entire process.

Scope definition. Precisely delineate which systems, processes, locations, and regulations the audit covers. A poorly defined scope generates ambiguity and irrelevant findings.

Criteria selection. Identify the requirements against which the audit will evaluate: ISO 27001 Annex A controls, ENS measures by category, applicable GDPR requirements, or the organization’s internal policies.

Program development. Define the schedule, required resources (auditors, tools), contacts in each area, and evaluation methods (interviews, document review, technical testing, direct observation).

Audit risk analysis. Identify the highest-risk areas to concentrate audit resources on them. An up-to-date risk analysis is a key input for this phase.

Prior communication. Inform the managers of the areas being audited about the scope, schedule, and expectations. The cooperation of audited staff is essential for an effective audit.

Phase 2: Execution

Execution is the phase where evidence is collected to support the audit conclusions.

Document review. Analysis of policies, procedures, records, plans, reports, and other documents that evidence the existence and implementation of controls. It verifies that documentation is current, approved, communicated, and accessible to relevant staff.

Interviews. Structured conversations with process owners, system administrators, operational staff, and management. Interviews verify that staff know and follow documented procedures and identify discrepancies between documentation and actual practice.

Technical testing. Technology verifications that confirm the effective implementation of controls: system configuration reviews, patch application checks, data encryption verification, backup restoration tests, access log reviews.

Direct observation. On-site verification of physical and procedural controls: physical access to facilities, information media management, staff working practices (screen locking, personal device usage).

Sampling. When the volume of records or transactions is very large, representative samples are selected for review. The sample size and method must be documented and justified.

Phase 3: Findings

Findings are the auditor’s conclusions about each area evaluated, supported by evidence. Each finding is classified by severity:

Major non-conformity: significant failure to meet a requirement that jeopardizes the effectiveness of the security management system or creates a serious risk. Example: absence of a security incident management process.

Minor non-conformity: an isolated failure that does not compromise the overall effectiveness of the system but requires correction. Example: a procedure that has not been reviewed within the established timeframe.

Observation: an area where an improvement opportunity is identified without a formal breach. Example: a process that works correctly but could benefit from greater automation.

Conformity: the evaluated control meets the requirements and functions effectively.

Each finding should be documented with the reference to the evaluated requirement, the finding description, the supporting evidence, the severity classification, and the auditor’s recommendation.

Phase 4: Audit report

The report is the audit’s primary deliverable and must be clear, precise, and actionable.

The typical structure of an audit report includes an executive summary (for management, with the main conclusions and the overall compliance level), the scope and audit criteria, the methodology employed, the detail of findings classified by severity, prioritized recommendations, and annexes with supporting evidence.

The report should be written in a way that allows the organization to understand exactly what needs to be corrected, why, and with what priority. Vague findings or generic recommendations reduce the report’s usefulness.

Phase 5: Follow-up

The audit does not end with the delivery of the report. The follow-up phase verifies that identified non-conformities are corrected within the agreed timeframes and that corrective actions are effective.

For each non-conformity, a corrective action plan is defined with an assigned owner, deadline, and expected closure evidence. The auditor or the security officer performs follow-up checks to confirm the implementation and effectiveness of the corrections.

How is evidence managed in an audit?

Evidence management is one of the most demanding aspects of the audit process, both for the auditor and for the audited organization.

Types of evidence

Evidence can be documentary (approved policies, training records, committee minutes), technical (screenshots of configurations, scan results, exported logs), testimonial (staff statements during interviews), or observational (the auditor’s direct findings).

Evidence management principles

Sufficiency: evidence must be sufficient to support the auditor’s conclusion. A single piece of evidence is rarely enough; triangulation of evidence from different sources increases confidence.

Relevance: each piece of evidence must be directly related to the requirement being evaluated.

Reliability: evidence must come from reliable and verifiable sources. A screenshot of a current configuration is more reliable than a verbal statement about how the system is configured.

Traceability: each piece of evidence must be linked to the finding it supports, with the date of collection and source identified.

Organization and storage

An organized evidence management system saves significant time during the audit and in subsequent audits. It is recommended to structure evidence by control or requirement, with a consistent naming convention and a log linking each piece of evidence to the corresponding finding.

Riskitera automates the collection of security evidence, extracting data directly from systems and organizing it by regulatory control, drastically reducing the manual effort of audit preparation.

What reference frameworks are used in security audits?

ISO 19011

ISO 19011 is the international standard that provides guidelines for auditing management systems. Although it is generic (applicable to any management system, not just security), it establishes the fundamental audit principles (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach), the required competencies of auditors, the management of audit programs, and the execution of individual audits.

ISO 19011 is the methodological reference for ISMS internal audits based on ISO 27001 and for ENS conformity audits.

ISACA and IS audit frameworks

ISACA (Information Systems Audit and Control Association) is the leading professional organization for information systems auditing. Its COBIT framework provides an IT governance and management framework that includes specific assurance and audit processes.

The CISA (Certified Information Systems Auditor) certification from ISACA is the most recognized professional credential for IT security auditors. The CISA preparation manual covers audit methodologies, techniques, and tools in detail.

ISACA also publishes ITAF (IT Assurance Framework), a detailed framework for planning, executing, and reporting on IT audits, with practical guidance for each phase of the process.

CCN-STIC guides

Spain’s National Cryptographic Center has published numerous CCN-STIC guides relevant to security auditing within the ENS framework, including specific guides for conformity auditing, security profiles for different technology platforms, and security evaluation procedures. These guides are mandatory for public sector bodies and serve as a valuable reference for any organization.

What tools are used in security audits?

Audit management tools

GRC (Governance, Risk, Compliance) platforms such as Archer, ServiceNow GRC, or specialized tools like AuditBoard provide modules for planning audits, managing findings, storing evidence, and tracking corrective actions.

Technical audit tools

For technical audits, key tools include vulnerability scanners (Nessus, OpenVAS, Qualys), configuration analysis tools (CIS-CAT, Lynis, ScoutSuite for cloud), network traffic analyzers (Wireshark, Zeek), penetration testing tools (Burp Suite, Metasploit), and code review tools (SonarQube, Semgrep).

Evidence collection automation

Manual evidence collection is one of the most time-consuming processes during an audit. Automation through scripts that export configurations, generate compliance reports, and collect relevant logs significantly reduces the effort. Compliance-as-code tools such as Chef InSpec or Open Policy Agent allow controls to be defined as code and their compliance to be verified in an automated and continuous manner.

How to automate security audits

The trend toward continuous auditing represents a significant shift from the traditional model of point-in-time audits.

From point-in-time to continuous auditing

The traditional model of annual or semi-annual audits has a fundamental limitation: it provides a snapshot of compliance at a specific moment, but the security state changes continuously. A control that was compliant on the audit date may cease to be so the very next day.

Continuous auditing uses automation to verify compliance on an ongoing basis, generating alerts when deviations are detected. This enables problems to be corrected immediately rather than being discovered months later.

Compliance as Code

The compliance-as-code approach involves expressing security controls as automated tests that run continuously against the infrastructure. For example, a control requiring all servers to have disk encryption enabled translates into a script that automatically verifies this configuration across all servers and generates an alert when a non-compliant server is detected.

Frameworks like CIS Benchmarks provide predefined security profiles that can be automated with compliance-as-code tools for continuous verification.

Integration with risk management

The results of automated audits feed directly into the risk management process: a control that falls out of compliance automatically increases the associated risk level, triggering the corresponding treatment processes. This bidirectional integration between auditing and risk management is a hallmark of mature GRC programs.

How to prepare for an external audit

Preparation is decisive for the outcome of an external audit. These are the key actions:

Conduct a prior internal audit. An internal audit performed months before the external audit allows non-conformities to be identified and corrected before the external auditor finds them.

Verify that documentation is up to date. Policies, procedures, records, and plans must be in their current version, approved, and accessible. Outdated or unapproved documentation is a frequent and avoidable finding.

Prepare evidence in advance. Collect and organize the evidence the auditor will request based on the audit scope. A well-organized evidence dossier speeds up the process and conveys an image of maturity.

Train staff. People who will be interviewed during the audit should know the policies and procedures for their area and be able to explain how they apply them in their daily work.

Designate an audit coordinator. A person who serves as the point of contact with the auditor, coordinates logistics, facilitates access to systems and documentation, and resolves issues during the process.

Review findings from previous audits. Verify that all non-conformities from prior audits have been closed and that corrective actions were effective. Recurring findings send a negative signal to auditors.

Frequently asked questions

How often should a security audit be conducted

The frequency depends on the applicable regulatory framework and the organization’s maturity. ISO 27001 requires planned internal audits at least annually. The ENS requires conformity audits every two years for medium and high categories. Regardless of regulatory requirements, it is recommended to conduct internal audits at least once a year and technical audits (vulnerability scans) quarterly or more frequently.

What is the difference between an audit and a penetration test

An audit evaluates the conformity of security controls against a reference framework (standard, regulation, internal policy), covering technical, organizational, and procedural aspects. A penetration test is a technical exercise that simulates a real attack to identify exploitable vulnerabilities. They are complementary activities: the audit verifies that controls exist and are properly managed; the pentest verifies whether they are effective against an attack.

Who can perform an internal security audit

An internal audit can be carried out by organization staff with audit training and information security knowledge, provided they are independent of the area being audited. It can also be assigned to external consultants acting on the organization’s behalf. ISACA’s CISA or ISO 27001 Lead Auditor certifications are credentials that demonstrate auditor competence, although they are not mandatory for internal audits.

What happens if a major non-conformity is found in an external audit

In an ISO 27001 certification audit, a major non-conformity prevents the certificate from being issued until it is corrected. The organization has a limited timeframe (typically 90 days) to implement the corrective action and present evidence to the certification body. If the correction is effective, the certification can be issued. If it is not corrected in time, the audit is considered unsatisfactory and must be repeated.

How can I reduce the cost and effort of audits

Automation is the primary lever for reducing audit costs. Automating evidence collection, technical control verification, and report generation can reduce preparation effort by 60 to 70 percent according to industry estimates. Additionally, keeping documentation continuously up to date (rather than rushing to update it before each audit) and using a centralized GRC platform that links controls, evidence, and findings significantly reduces the effort for both the audited party and the auditor.