An audit that tells you whether your compliance will hold
We test your security against the yardstick you choose: a standard, your own policies or the questionnaire a client just sent you. Then we tell you where it bends.
Overview
What an information security audit is
An audit compares what you say you do with what you actually do. The yardstick can be ISO/IEC 27001 and the guidance in ISO/IEC 27002, the GDPR, PCI DSS, another framework, your own policy set, or a security questionnaire from a client.
We read the documents, interview the people who own the controls and then sample the evidence. A policy that says access is reviewed quarterly is worth what the last review record shows. We try the handle first, then read the sign on the door.
An internal or pre-assessment audit is not a certificate. ISO/IEC 27001 certificates come from accredited certification bodies, PCI DSS reports on compliance from Qualified Security Assessors where one is required, and GDPR compliance is ultimately judged by the supervisory authorities. Black Fox shows you where you stand before they look.
Who it is for
Organisations preparing for an ISO/IEC 27001 certification or surveillance audit, a PCI DSS assessment or a client's supplier review, and teams that want an outside view of whether their own policies are followed. Also for companies that need the internal audit ISO/IEC 27001 asks for and have no independent people to run it.
The work, from scoping to evidence.
What we do
Choosing the yardstick
We agree what you are audited against: a standard, a regulation, your policies, a contract or a client questionnaire, or a combination of them.
Document review
Policies, procedures, risk records and previous audit reports, read for what they require and whether they agree with each other.
Interviews
Conversations with control owners, IT staff and managers, to see whether the written process is the one people follow.
Evidence sampling
Tickets, logs, access lists, backup records and configuration exports, sampled to test that controls operate and not only exist.
Technical checks
Where the audit calls for it, targeted checks of configurations on network devices, endpoints, servers and applications.
Internal audit for ISO/IEC 27001
The internal audit the standard requires, run by people independent of those who built the controls.
How the engagement runs
Kickoff
We agree the yardstick, the scope, the people involved and the sampling period, and sign an NDA first if you need one.
Proposal and audit plan
A business proposal with the audit plan: what we review, whom we interview and which evidence we will ask for.
Fieldwork
Document review, interviews, evidence sampling and technical checks, with findings shared as they firm up.
Results handover
Findings rated by risk, each with the requirement, the evidence and a recommendation, walked through with your team.
Closing
We close the project, collect your feedback and, if you want, agree a follow-up check on the corrective actions.
What you receive
- Audit plan and scope statement
- Business report with a risk assessment of the findings
- Technical report with evidence and proofs where relevant
- Findings mapped to the requirement they relate to
- Prioritised recommendations and corrective action list
- Optional certificate of engagement, verifiable on our site
Questions
Is this the same as a certification audit?
No. Certification audits are performed by accredited certification bodies, and PCI DSS reports on compliance by Qualified Security Assessors. Our audit tells you how you would fare and what to fix. When you go on to certification, we coordinate the audit with our long-standing certification partners or a body of your choice. Our certificate of engagement records that the audit took place; it is not a compliance certification.
Can you audit us against a client's questionnaire?
Yes. We treat the questionnaire as the yardstick, check your answers against evidence and tell you which ones you can defend and which ones need work before you send them.
Is the audit only about documents?
No. Documents set the expectation, but the audit tests whether controls operate. Where it helps, we add technical checks of configurations, or a penetration test as a separate engagement.
Can you run our ISO/IEC 27001 internal audit if you helped us implement?
The standard asks for an objective and impartial internal audit. If we built your controls, we agree with you how to keep the internal audit impartial, which can mean recommending another auditor for that part.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationGDPRGDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests.
- Compliance and certificationPCI DSSPCI DSS support from Black Fox Security: scoping and segmentation, gap assessment, SAQ support, penetration and segmentation testing, and evidence for your assessor.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
Find out before the auditor does
Tell us what you are measured against and when. We will plan an audit that tests it.