Does the organization have Internal Audit procedures and do they: Conform to the requirements of the International Standard and relevant legislation or regulations; Conform to the identified information security requirements; Are effectively implemented and maintained; and Perform as expected? Are all security - related processes and procedures audited at least once per year? Does the organization continually improve the effectiveness of its BIA through the use of: Policy and objectives Audit results Analysis of data Corrective and preventive actions Management review? Summary All organizations are subject to incidents and disruptions of operations resulting from terrorist or cyber-attack, natural disasters such as hurricanes, earthquakes, or floods, or internal occurrences such as fires, utility outages, hacking, or HAZMAT spills. Business Impact Analysis, when merged with an organization’s overall Risk Management strategy, identifies and defines potential threats in of operational and financial consequences. More importantly, BIA helps Management to predict and prepare for incidents, and in doing so, mitigate or minimize them. Good managers do BIA good auditors help. – Chapter Four Business Continuity Management – Overview Organizations need to make Security a key mission, and then approach it like any other: establish policies and procedures, identify threats, conduct risk assessments, implement processes, identify corrective actions, train/qualify key people, and establish a mindset of continuous improvement. And audit. It is my hope that managers and auditors will to want create, maintain, and continually improve robust organizational security programs and track them on a daily basis, as they would with any other indispensable business function. Points/Review The impact of a natural or man-made incident to an organization can be minor, major, or disastrous, depending on not only the magnitude of the incident, but also on the organization’s ability to anticipate that incident, defend the organization from it, and mitigate its effects as quickly and safely as possible.
Does the organization have Internal Audit procedures and do they: Conform to the requirements of the International Standard and relevant legislation or regulations; Conform to the identified information security requirements; Are effectively implemented and maintained; and Perform as expected? Are all security - related processes and procedures audited at least once per year? Does the organization continually improve the effectiveness of its BIA through the use of: Policy and objectives Audit results Analysis of data Corrective and preventive actions Management review? Summary All organizations are subject to incidents and disruptions of operations resulting from terrorist or cyber-attack, natural disasters such as hurricanes, earthquakes, or floods, or internal occurrences such as fires, utility outages, hacking, or HAZMAT spills. Business Impact Analysis, when merged with an organization’s overall Risk Management strategy, identifies and defines potential threats in of operational and financial consequences. More importantly, BIA helps Management to predict and prepare for incidents, and in doing so, mitigate or minimize them. Good managers do BIA – good auditors help. Chapter Four – Business Continuity Management Overview Organizations need to make Security a key mission, and then approach it like any other: establish policies and procedures, identify threats, conduct risk assessments, implement processes, identify corrective actions, train/qualify key people, and establish a mindset of continuous improvement. And audit. It is my hope that managers and auditors will to want create, maintain, and continually improve robust organizational security programs and track them on a daily basis, as they would with any other indispensable business function. Points/Review The impact of a natural or man-made incident to an organization can be minor, major, or disastrous, depending on not only the magnitude of the incident, but also on the organization’s ability to anticipate that incident, defend the organization from it, and mitigate its effects as quickly and safely as possible.
Auditing_Organizational_Security.docx