# A Client-Centered Information Security and Cybersecurity Auditing Framework
## 3 Information System for Security Auditing  
The Information System (IS) described in this paper was initially built and tested for ISO 27001:2013 auditing. However, it was designed to support other standard specifications, as the application can be customized to load any ISMS. The customizable approach under the web application was tailored to the following main presumptions:  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline  
* A checklist for each control is available as a set of actions to be applied during the auditing.
* These actions are specific elements to check by a \"true/false\" answer, and the result allows an auditor to better define an acceptable percentage for each control. In a first auditing intervention, the overall checklist is verified and the level of acceptance is calculated.
* A list of mitigation actions is available for each control. Depending on the level of acceptance related to each control, after the first auditing, the team receives an automatically generated list of mitigation tasks to be applied, in order to decrease the risk of the control being evaluated and raise the acceptance level.
* When a second intervention occurs, each control is re-evaluated, to assess the impact of the countermeasures that were identified and applied after the first intervention.  
One of the main reasons behind this approach is to allow the IS to be used in companies of different sizes and with distinct technological maturities. The ability to split the objectives of each control into a set of actions to be performed in an audit has the main advantage of providing more flexibility to process the actions' list. The standards are very strict and usually do not allow this kind of flexibility.  
In our case study summarized in Section 4 and detailed in [24], it was possible to monitor and make a diagnosis about the cybersecurity and information security risks observed in the fifty intervened SMEs, according to the data collected during the auditing process, namely on both interventions.  
The IS was designed as a web application for the benefit of being platform agnostic. This means that any auditor may use the application regardless of his/her own environment or that of the company being audited. As the auditor can define and customize the actions to be validated for each control, the proposed solution can be adjusted to fit the auditing process to the organizational context of each intervened company. The proposed solution can be tailored to the common auditing standards, namely the ISO-27000 family, which contrasts with the overall auditing solutions available (Section 2). The following subsections detail the architecture, the data model, and the reasons behind the choices made during the development.  
The IS presented in this work was developed to support the auditing process applied to the fifty SMEs. Indeed, the aim in developing and proposing this tailored software was to allow all the authors to have constant access to the occurring process, making all data available when needed. The challenges and amount of data gathered in a process of this nature are known to be great. Therefore, the scope and aim are essentially to make all the data available when needed. This proof of concept allowed us to focus on and determine the best requirements for a system of this nature. The benefits of having a system that automates the registration and standardization of the data collection are some the key outputs.