Security Audit Program
ISO 27001 & ISO 27002 / HIPAA / SOX PCI-DSS Compliant
Many organizations have to respond to the queries of internal or external auditors and demonstrate that access to their unstructured data is being properly controlled. Questions such as the following from auditors are not uncommon:
- How do you know who can access this folder with financial/customer/sensitive data in it?
- Who authorized a user to have access permission to a file and how?
- If a key file was deleted, how would you know it happened, or who did it?
- Who were the last people to access a critical folder, and what did they do?
- How do you make sure that the right people have access to your data?
After years of regulation and embarrassing data breaches, the highest levels of management now comfortably discuss IT controls and audit results. However, their quality expectations are rising. Where IT once performed audits annually, many now support quarterly, monthly, and ad hoc exercises. Each audit expands the scope of the technologies assessed, measured, and proven compliant. Broader scope means more complexity and more work. With the Security Audit Program you can increase timeliness and accuracy of audit data while reducing IT audit effort, disruption, and cost.
This Security Audit program contains over 400 unique tasks divided into 11 areas of audit focus which are the divided into 38 separate task groupings. The audit program is one that either an external auditor, internal auditor can use to validate the compliance of the Information Technology and the enterprise to ISO 27000 Series (ISO 27001 & ISO 27002), Sarbanes-Oxley, HIPAA, and PCI-DSS.
The 11 areas of audit focus and objectives are:
- Corporate Security Management
- Systems Development and Maintenance
- Information Access Control Management
- Compliance Management
- Human Resource Security Management
- Information Security Incident Management
- Communications and Operations Management
- Organizational Asset Management
- Physical and Environmental Security Management
- Security Policy Management
- Disaster Recovery Plan and Business Continuity
Included with this program are Microsoft (2003 and 2007 format) Excel workbooks and an indexed PDF document that contain the following:
- Read me - General instructions on the use of the Excel worksheets
- Audit Program Summary - Lists the 11 areas of audit focus and the 38 task groupings that are included within the audit. The point summary on this work sheet is calculated automatically by Excel.
- Audit Program Detail - Lists over 400 detail tasks the need to be completed in the audit and the relative point value of each task. The only thing that the user needs to do is check the yes or no on each item and re-assign a relative point value for each task.
- Audit Program Graphic - Lists the 11 areas of audit focus and a bar graph which shows the weights that are assigned to each area. The point summary on this work sheet is calculated automatically by Excel and the graph is automatically updated.
- Sample Audit Program - This is copy of the Audit Program Detail with data entered into the individual tasks.
- Sample Audit Program Summary - This is a copy of the Audit Program Summary with the links changed to point to the Sample Audit Program.
- Sample Audit Program Graphic - This is a copy of the Audit Program Graphic with links changed to point to the Sample Audit Program plus a chart has been added to show the positive and negative points of the audit. (see chart below)
This is a summary graphic that was produced from the Excel worksheet provided as the Audit Program. In the sample above it is easy to see those areas where improvement is need.
Security Audit Program
- Comes in MS EXCEL and PDF formats
- Meets ISO 27001, 27002, Sarbanes-Oxley, PCI-DSS and HIPAA requirements
- Over 400 unique tasks divided into 11 areas of audit focus which are the divided into 39 separate task groupings including BYOD
Over 3,000 enterprises from around the world have chosen at least one of Janco's products. The Security Audit program is a must have tool that not only assists in meeting compliance requirements but also is a great way to validate that your enterprise is ready for your next external audit.
Disaster Recovery Business Continuity Standard Edition
- Disaster Recovery Business Continuity Template (WORD)
- Disaster Recovery Business Continuity Audit Program - Compliant with ISO 27031 and ISO 22301
- Disaster Recovery Manager Job Description
- Manager Disaster Recovery & Business Continuity Job Description
- Application Inventory and Business Impact Analysis Questionnaire
- Incident Communication Plan and Policy with BEST PRACTICES for
- News Conferences
- Media Relations
- Social Network Checklist
- Included with the template are Electronic Forms which have been designed to lower the cost of maintenance of the plan. Electronic Forms that can be eMailed, completed via a computer or tablet, and stored electronically including:
- LAN Inventory
- Location Contact Numbers
- Off-Site Inventory
- Personnel Locations
- Plan Distribution
- Remote Location Contact Information
- Team Call List
- Vendor Contact Information
- Added Bonus - Safety Program Electronic Forms
- Area Safety Inspection
- Employee Job Hazard Analysis
- First Report of Injury
- Inspection Checklist – Alternative Locations
- Inspection Checklist – Office Locations
- New Employee Safety Checklist
- Safety Program Contact List
- Training Record
Security Manual Template - Standard Edition
- Security Manual Template
- Business and IT Impact Questionnaire
- Threat and Vulnerability Assessment Toolkit
- Security Management Checklist
- HIPAA Audit Program
- Sarbanes Oxley Section 404 Checklist
-
Electronic forms that can be Emailed, completed via a computer or tablet, and stored electronically including:
- Blog Policy Compliance
- BYOD Access and Use
- Company Asset Employee Control Log
- Email - Employee Acknowledgment
- Employee Termination Checklist
- FIPS 199 Assessment Electronic Form
- Internet Access Request
- Internet Use Approval
- Internet & Electronic Communication - Employee Acknowledgment
- Mobile Device Access and Use Agreement
- Employee Security Acknowledgement Release
- Preliminary Security Audit Checklist
- Security Access Application
- Security Audit Report
- Security Violation Reporting
- Sensitive Information Policy Compliance Agreement
- Threat and Vulnerability Assessment (Adobe FormsCentral - PDF)
Security Audit Program
- Comes in MS EXCEL and PDF formats
- Meets ISO 27001, 27002, Sarbanes-Oxley, PCI-DSS and HIPAA requirements
- Over 400 unique tasks divided into 11 areas of audit focus which are the divided into 39 separate task groupings including BYOD
Over 3,000 enterprises from around the world have chosen at least one of Janco's products. The Security Audit program is a must have tool that not only assists in meeting compliance requirements but also is a great way to validate that your enterprise is ready for your next external audit.
Disaster Recovery Business Continuity Audit Program
- Comes in MS WORD format and PDF
- Meets ISO 27001, 27002, 27031 Sarbanes-Oxley, PCI-DSS, FIPS-199, and HIPAA requirements
- 36 specific items that the audit covers in the 13 page audit program
Disaster Recovery Business Continuity Audit Program
- Comes in MS WORD format and PDF
- Meets ISO 27001, 27002, 27031 Sarbanes-Oxley, PCI-DSS, FIPS-199, and HIPAA requirements
- 36 specific items that the audit covers in the 13 page audit program
Security Manual Template - Standard Edition
- Security Manual Template
- Business and IT Impact Questionnaire
- Threat and Vulnerability Assessment Toolkit
- Security Management Checklist
- HIPAA Audit Program
- Sarbanes Oxley Section 404 Checklist
-
Electronic forms that can be Emailed, completed via a computer or tablet, and stored electronically including:
- Blog Policy Compliance
- BYOD Access and Use
- Company Asset Employee Control Log
- Email - Employee Acknowledgment
- Employee Termination Checklist
- FIPS 199 Assessment Electronic Form
- Internet Access Request
- Internet Use Approval
- Internet & Electronic Communication - Employee Acknowledgment
- Mobile Device Access and Use Agreement
- Employee Security Acknowledgement Release
- Preliminary Security Audit Checklist
- Security Access Application
- Security Audit Report
- Security Violation Reporting
- Sensitive Information Policy Compliance Agreement
- Threat and Vulnerability Assessment (Adobe FormsCentral - PDF)
Disaster Recovery Business Continuity Standard Edition
- Disaster Recovery Business Continuity Template (WORD)
- Disaster Recovery Business Continuity Audit Program - Compliant with ISO 27031 and ISO 22301
- Disaster Recovery Manager Job Description
- Manager Disaster Recovery & Business Continuity Job Description
- Application Inventory and Business Impact Analysis Questionnaire
- Incident Communication Plan and Policy with BEST PRACTICES for
- News Conferences
- Media Relations
- Social Network Checklist
- Included with the template are Electronic Forms which have been designed to lower the cost of maintenance of the plan. Electronic Forms that can be eMailed, completed via a computer or tablet, and stored electronically including:
- LAN Inventory
- Location Contact Numbers
- Off-Site Inventory
- Personnel Locations
- Plan Distribution
- Remote Location Contact Information
- Team Call List
- Vendor Contact Information
- Added Bonus - Safety Program Electronic Forms
- Area Safety Inspection
- Employee Job Hazard Analysis
- First Report of Injury
- Inspection Checklist – Alternative Locations
- Inspection Checklist – Office Locations
- New Employee Safety Checklist
- Safety Program Contact List
- Training Record
Security Auditing News
New Privacy Legislation Proposed in US House
May 12th, 2013
New Privacy Legislation – Application Privacy, Protection and Security (APPS) Act 2013 Proposed privacy legislation bill would require application developers to explicitly gain consent before obtaining data from consumers, and compel them to securely maintain that data in accordance with … Continue reading
The post New Privacy Legislation Proposed in US House appeared first on IT Manager - CIO.
- more info
Security breaches occur when former employees are unhappy
May 10th, 2013
CIO security issue – Former employees can easily breach networks Security Warning – The importance of a termination procedures and lock-down of systems after key system administrators leave an organization are an on-going issue that CIOs need to address. In … Continue reading
The post Security breaches occur when former employees are unhappy appeared first on IT Manager - CIO.
- more info
CIOs worry more about cyber threats with mobile computing
May 10th, 2013
Cyber threats are now a much greater concern with the expansion of the use of mobile devices and services. At the same time online criminals have stepped up attacks via email, web and other traditional vectors. Recent research shows a … Continue reading
The post CIOs worry more about cyber threats with mobile computing appeared first on IT Manager - CIO.
- more info
10 reasons why organizations need a Chief Mobility Officer (CMoO)
May 7th, 2013
Chief Mobility Officer (CMoO) business case Here are ten reasons your company needs a chief mobility officer: To deliver mobility solutions for the enterprise to provide the necessary competitive edge before the competition and at least in a timely manner … Continue reading
The post 10 reasons why organizations need a Chief Mobility Officer (CMoO) appeared first on IT Manager - CIO.
- more info
CIOs Worry More About Cyberthreats
May 5th, 2013
CIOs face more cyber threats Cybert hreats are now a much grater concern with the expansion of the use of mobile devices and services. At the same time online criminals have stepped up attacks via email, web and other traditional … Continue reading
The post CIOs Worry More About Cyberthreats appeared first on IT Manager - CIO.
- more info
10 things to do after explosion, terrorist attack, or random act of violence
April 22nd, 2013
10 Things To Do After an Explosion, Terrorist Attack, or a Random Act of Violence After an explosion, terrorist attack, or other random act of violence there can be a second event that cause as much damage as the first … Continue reading
The post 10 things to do after explosion, terrorist attack, or random act of violence appeared first on IT Manager - CIO.
- more info
Two factor authentication soon to be a standard
April 19th, 2013
Two factor authentication increases security Two factor authentication in addition to complex passwords are very difficult to guess or even crack using commonly available code breaking software. Password complexity is often built on the length of the word and the … Continue reading
The post Two factor authentication soon to be a standard appeared first on IT Manager - CIO.
- more info
Many CIOs have not addressed cloud security issues
April 15th, 2013
Less than 50% of all organizations have policies in place that for vetting cloud computing applications for possible security risks before deploying them. The number of CIO saying that risks need to be assessed prior to cloud adoption is 10%. … Continue reading
The post Many CIOs have not addressed cloud security issues appeared first on IT Manager - CIO.
- more info
Social media policy needed to meet internal audit requirements
April 12th, 2013
Social Media Policy is Missing in Over 50% of all Organizations Internal audit has never been easy, and a recent survey shows that 43% of companies have no social media policy within their organization. Among those with a policy, many … Continue reading
The post Social media policy needed to meet internal audit requirements appeared first on IT Manager - CIO.
- more info
Mandated breach notification laws are in place in 46 states
April 7th, 2013
Mandated Breach Notification Laws Forty-six states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information. Alaska Alaska Stat. § 45.48.010 et seq. Arizona Ariz. Rev. Stat. § 44-7501 Arkansas Ark. Code § … Continue reading
The post Mandated breach notification laws are in place in 46 states appeared first on IT Manager - CIO.
- more info