Cyber Security Capability Framework & Mapping of ISM Roles - agimo

TECHNOLOGY AUDIT The independent, risk-based assessment of the adequacy and integrity of controls in informationprocessing systems, including hardware, software solutions, information management systems, security systems and tools,communications technologies – both web-based and physical. The structured analysis of the risks to achievement of businessobjectives, including the risk that the organisation fails to make effective use of new technology to improve delivery and internaleffectiveness.EL 1 EL 21. Evaluates functional operation and performance in light of test results andmakes recommendations regarding certification or accreditation.2. Examines vulnerabilities and determines actions to mitigate them. Developsand applies effective vulnerability countermeasures.3. Analyses information security vulnerability bulletins for their potential impact onthe computing or network environment, and takes or recommends appropriateaction.4. Performs risk assessment, business impact analysis and accreditation for allmajor information systems within the organisation.5. Interprets patterns of non-compliance to determine their impact on levels of riskand/or overall effectiveness of the organisation’s information technologysecurity program.6. Oversees the development of organisational logging standards to comply withaudit requirements.1. Develops plans for risk-based audit coverage of technology systems forinclusion in audit planning and uses experience to ensure audit coverage issufficient to provide the business with assurance of adequacy and integrity.2. Leads and manages complex technical audits, managing specialistscontracted to contribute highly specialised technical knowledge andexperience.3. Identifies areas of risk and specifies interrogation programs. Recommendschanges in processes and control procedures based on audit findings,including, where appropriate, the assessment of safety-related softwaresystems to determine compliance with standards and required levels of safetyintegrity.4. Provides general and specific advice, and authorises the issue of formalreports to management on the effectiveness and efficiency of controlmechanisms.5. Reviews or develops effective vulnerability countermeasures6. Reviews the report of, or participates in, an information security riskassessment or review.7. Oversees the development of the audit planning process.Produced for AGIMO by Workplace Research Associates Pty Ltd 2010 Page 13