# A Client-Centered Information Security and Cybersecurity Auditing Framework
## 2 Background  
This section describes a subset of known tools available to support auditing interventions. ISO 27001:2013 is the most common and well-known information security standard, and its available tools were analyzed in depth. Table 1 enumerates the most relevant tools for ISO 27001:2013, which are classified into three dimensions: (i) type, which distinguishes the cloud-based tools and those that are based on spreadsheets and other documents; (ii) openness, as the tools can be commercial or supported by the community; and (iii) the technological maturity level.  
The analysis was intended to ascertain if the tools require an existing organizational structure, as well as the technological maturity of the companies, that is if the applications can be easily applied to both SMEs and large enterprises. The classification also distinguishes the tools that support different standards or compliance regulations, from those that were only developed to implement ISO 27001:2013 guidelines.  
As can be seen from Table 1, the available tools are mostly delivered as a Software-as-a-Service (SaaS) cloud applications. According to the documentation available, it is possible to infer that these applications are less suitable to SMEs or those with a low technological maturity. The cloud-based nature of these applications, such as the SaaS model, brings high flexibility to the end-users, as few technological requests are needed to setup an auditing process. These tools rely heavily on features that fit the organizational structure, such as the definition of strict responsibility assignments or documentation repositories that need to be referenced.  
There are a few document-based toolkits available, which are basically composed of general guidelines derived from templates, policies, and spreadsheets, to collect the necessary information about assets when an auditing process is being prepared. The Opensource GRC--ISO 27001 package is open source; the documentation is fed by the ISO 27001 community; it is composed of a web application that can be used for several standards; for each clause and control of the standard, it provides a set of documentation, such as templates or data collection documents. However, it does not have easy support to record auditing interventions, as it is designed to be used internally by companies, to assess and evaluate their compliance with the standards.  
Most of the solutions presented are not open source and require that the company has some level of technological maturity, which is not the common scenario in SMEs, if we think of those acting in the manufacturing industry. Those tools that are open source fail to support different standards, which gives less flexibility to the information security auditing and has a strong impact on the way an SME is able to choose and benchmark distinct standards.  
Based on the limitations described above and the lack of tailored solutions that could be set for the context of an auditing process, in this paper, we propose a web-based open-source solution that is able to record the auditing activity with different and heterogeneous information security standards. It is possible to support different instances of information security standards and to benchmark the results obtained. Each standard can be easily configured, by importing a list of controls and associated checklist actions and mitigation strategies. Therefore, the software instance can be tailored to support different standards and allows the incorporation of controls that are more suitable to the context of the company.