A cybersecurity audit is useful when it answers a defined question with evidence. The label alone does not tell you whether an engagement checks policy design, tests operating controls, examines a technical attack path or provides independent assurance to a customer. These activities can complement one another, but they produce different conclusions.
Before requesting a quote, identify the intended reader and the decision they need to make. A board considering investment, a buyer assessing a supplier and a certification body have different evidence needs. This guide helps you commission a review that is proportionate, intelligible and usable after the closing meeting.
Write the question before the scope
Replace a request to audit everything with a clear purpose. A business acquiring another company may need to understand inherited exposure and urgent integration constraints. A service provider may need to determine whether controls are ready for an independent examination. An internal audit team may need evidence that agreed policy operates consistently across locations.
Specify the business services, entities, locations, systems and period relevant to that purpose. Record exclusions with their rationale. If an essential supplier or recently acquired environment is excluded, explain what that means for the conclusion. A polished report covering only a small portion of the service should not be presented as assurance over the whole organisation.
Define the intended use of the report, including whether it will be shared externally. A private advisory assessment is not automatically suitable evidence for every customer’s procurement requirements. Confirm the recipient’s expectations early enough to choose the right engagement.
Distinguish the different forms of review
A gap assessment compares the current position with selected requirements and helps plan remediation. A technical security test examines specified systems or attack paths under agreed authorisation. An internal audit evaluates the organisation against its defined criteria and programme. Ask which activity is included instead of assuming that the word audit covers them all.
ISO management-system certification involves an external certification body; ISO itself does not issue the certificate. A SOC 2 engagement is an independent CPA examination resulting in a report. A consultant’s readiness review supports preparation but does not replace either of those assurance processes or guarantee the independent decision.
NIST also states that it does not certify CSF implementations or services. A report organised around the NIST Cybersecurity Framework can support decision making, but the report should accurately describe its criteria, methods and limitations. Our SOC 2 guide and ISO 27001 certification-audit guide explain those specific pathways.
Agree what evidence will support a conclusion
Ask the reviewer how the work will connect criteria, evidence and findings. NIST SP 800-53A provides a methodology for assessing security and privacy controls, with procedures that can be tailored. Your engagement should make the selected approach understandable to the people providing evidence and using the result.
A policy document can establish what management intends. It does not by itself show that a process operated. For an access review, useful evidence may include the population reviewed, decisions made, unresolved exceptions and completed removals. For restoration, it may include the test conditions and verification by the business owner. Agree how sampling and unavailable evidence will be described.
Protect the evidence collection process. Decide who can access records, where they will be stored, how sensitive material will be minimised and what happens after the engagement. Requesting entire production datasets by default can create unnecessary risk when selected, redacted evidence would answer the question.
Check competence, independence and testing authority
Match the proposed team’s competence to the scope. Experience reviewing policy does not automatically demonstrate the ability to test a specialist platform. Ask how technical areas, sector obligations and unfamiliar components will be covered, and how any dependency on another specialist will be agreed.
Where independence is necessary, disclose who designed or implemented the controls and how conflicts will be managed. Do not assume that a second person from the same engagement automatically supplies every form of required independence. The applicable assurance or audit arrangements determine what is acceptable.
If scanning or penetration testing is included, obtain explicit written authorisation, boundaries and operating constraints. Confirm the assets, time windows, third-party permissions, escalation contacts and stop conditions. An audit contract does not provide unlimited permission to probe connected customer or supplier environments.
Require a report that supports action
A useful finding identifies the relevant criterion, observed condition, evidence and consequence. It distinguishes a control failure from missing evidence or a matter outside scope. The report should make clear when an issue affects a selected sample and when broader examination supports a wider conclusion.
Hypothetical example: a growing payroll provider asks for a security audit before responding to a buyer. The review finds that administrator removal is documented but not evidenced for several departures. Management receives the population tested, affected accounts and the evidence limitation. It can then correct access and verify the process, rather than treating a generic recommendation to improve security as a completed action.
Agree a management response for each material finding: accountable owner, treatment decision, target date and closure evidence. Retesting should address the actual weakness. Uploading a new policy does not close a finding about transactions that were never reviewed.
Compare proposals on decision value
Compare scope and evidence depth before price. Two proposals with the same title may differ in the number of environments, operating periods, interviews, technical tests and opportunities to verify remediation. Ask each provider to identify dependencies, exclusions and work that would require a separate engagement.
Prepare a short commissioning brief with the business question, intended users, relevant criteria, available evidence and deadline. Identify the internal coordinator and decision makers who can resolve scope questions. This reduces the risk that fieldwork time is spent discovering who owns the service.
CyberVantage360’s assessment and readiness support can help define an appropriate scope and improvement plan. Where the question is specifically technical exposure, consider the separate security-testing service with agreed authorisation and test boundaries.
Reference basis
- NIST SP 800-53A Revision 5, Assessing Security and Privacy Controls in Information Systems and Organizations; public publication page and update note.
- NIST Cybersecurity Framework frequently asked questions, certification and endorsement statement.
- ISO, Certification: the role of external certification bodies.
- AICPA & CIMA, System and Organization Controls suite of services; public overview.
Questions and answers
Does a cybersecurity audit prove legal compliance?
A scoped review can provide evidence and identify gaps against selected requirements. It does not establish universal compliance with every applicable law or guarantee that a regulator will reach the same conclusion. Define the applicable obligations and obtain appropriate legal input where interpretation is needed.
Is a penetration test the same as an audit?
No. Penetration testing investigates defined technical weaknesses and attack paths under authorisation. An audit or control assessment may examine broader governance and operating evidence. Confirm whether technical testing is included and what it can establish.
Should every proposal use the same checklist?
Use common business objectives and criteria when comparing proposals, but allow justified differences in methods and evidence depth. A checklist is useful only when it fits the service, risks and intended use of the report.
What if requested evidence is unavailable?
Record the limitation honestly and assess its effect on the conclusion. Do not recreate historical approvals or present newly written procedures as evidence of past operation. Agree the corrective work and any later testing needed.
Can a readiness consultant issue our SOC 2 report?
The SOC 2 report comes from the independent CPA examination. Readiness consulting helps an organisation prepare its system description, controls and evidence; it should not be presented as the independent examination or a guaranteed opinion.
Scope the review before commissioning it
Share the business decision, proposed audience and deadline. Discuss the scope and evidence you need so the resulting work can support a clear next step.