# A Client-Centered Information Security and Cybersecurity Auditing Framework
###### Abstract
Broadly speaking, the auditing process involves the whole organization, as the consulting team has to collect and evaluate a list of predefined controls, which is mostly derived from the standards and documentation and best practices procedures available. Besides the NIST-CSF and ISO 27000 series standards' families, which are the most relevant and the best of breed in what cybersecurity and information security are about, some additional standards and frameworks could also be addressed, being however specific to the business area: ISO 22301:2012 [9] for business continuity management systems and the Health Insurance Portability and Accountability Act (HIPAA) [10] to protect the confidentiality and security of health care information and data. As these standards have controls, auditing tasks' lists, and mitigation measures, they could also be applied to the framework presented in this paper. However, our case study was the ISO 27001 standard and its adoption by SMEs. Each auditing process is composed of various auditing interventions, in which the team evaluates the level of compliance of each security control, by applying to it a predefined checklist. For each control, a list of mitigation tasks is already defined and delivered to guide the auditor during the auditing interventions. After assessing all the controls, a global compliance score is calculated. For those controls that are not fully compliant with the standard that is being applied in the auditing, a list of countermeasures and mitigation tasks is proposed to the enterprise, as they can be implemented and further evaluated during the auditing process. The auditing process can take several weeks or months, depending on several factors, such as the number of employees, the organizational complexity, the preparedness of the information system infrastructure, and the level of knowledge about the business and the technological infrastructure that supports it. During the auditing process, a considerable number of interventions may have to be made, mostly on-site, where physical validation of existing software and hardware takes place, as well as the identification of assets and of business processes. Data are collected and stored in each auditing intervention for further analysis and reporting. The initial auditing implies an auto-diagnosis of the enterprise regarding cybersecurity. Depending on the score attained, several mitigation tasks may be proposed to be implemented. Each subsequent auditing intervention is essentially dedicated to the evaluation of the impact that each mitigation had on the overall security auditing, that is the aim of the several auditing interventions that may take place is to evaluate and assess the enhancements obtained with the countermeasures that were proposed by the auditing team. At the end, the compliance level of the enterprise regarding cybersecurity and information security issues should increase and may demonstrate the continuous readiness of the enterprise. Each well-adopted information security, privacy, and cybersecurity international standard has its own set of tools and best practices, available elsewhere to be applied by the enterprises and auditing teams. However, these tools and the existing Information Systems (ISs) that support them to manage cybersecurity and information security auditing processes are mainly oriented toward a particular standard. The reasons are mainly the inflexibility of these tools to accommodate different standards and their corresponding structures and checklists. Some of the existing standards are also hard to apply in a set of heterogeneous enterprises, and in some cases, the supporting tools are shallow and fed by the information security auditing community, which gives less confidence about their adoption in wide auditing scenarios. These auditing applications usually fall into two distinct groups: proprietary and oriented toward complex auditing processes in big companies; open source, usually free-of-charge, and mainly composed of spreadsheet-based toolkits delivered by the community.