How to Perform an Information Security Audit

Learn to Perform Information Security Audits with Expert Guidance

This comprehensive course equips IT and information security professionals and auditors with the skills to effectively assess and improve organizational security. Whether you're looking to enhance your own security assessments or deepen your expertise in information security audits, this course provides the knowledge and tools you need.

What You'll Learn:

• Planning Information Security Audits: Master the process of planning security audits, including defining objectives, scope, and criteria. Learn to create effective working papers and assemble skilled audit teams.
• Executing Security Audit Engagements: Develop proficiency in gathering, analyzing, and evaluating engagement information. Understand how to effectively supervise audit activities to ensure thoroughness.
• Communicating Audit Results: Gain expertise in communicating audit findings, risk acceptance processes, and monitoring the implementation of remediation recommendations.
• Identifying Information Security Threats: Understand and assess a wide range of information security threats, including data integrity, confidentiality, and availability risks. Learn to evaluate privacy risks, threats from smart devices, insider threats, malicious software, and broader cybersecurity threats. Utilize the Asset-Threat-Vulnerability model for effective risk assessment.
• Implementing Information Security Controls: Explore various information security controls, including IT general controls. Learn to establish strong information security governance through effective IT management and governance controls. Implement segregation of duties, IT departmentalization, and adopt a robust information security framework and cybersecurity governance policies. Understand and apply the Three Lines of Defense Model in cybersecurity.
• Control Implementation: Gain practical knowledge of implementing key controls such as identity access management and authentication, encryption, firewalls, data privacy and protection controls, application and access controls, technical IT infrastructure controls, external connections controls, and third-party information security controls.

Taught by: Adrian Resag, a CISA certified information security auditor with decades of experience evaluating information security, IT security, and ISO 27001 across diverse organizations.

This course provides a practical roadmap for conducting thorough and impactful information security audits, enabling you to strengthen your organization's security posture.