# A Client-Centered Information Security and Cybersecurity Auditing Framework
## 3 Information System for Security Auditing
### Database Model  
The data modeling design included the ISO 27001:2013 standard controls, lists of actions, and mitigation task lists, but not making them explicitly dependent. Therefore, by using this strategy, any other auditing standard can be loaded to the database without additional changes needed to the data model. The data model entities are represented in the database scheme depicted in Figure 4. As can be seen, there is only one direct dependency between the ISO 27001:2013 parts of the data model and the controls' identification. This dependency can be easily assumed to be present in any standard, that is the entities Clauses, Categories, and Controls (upper left of Figure 4) are parts of the standards and are mapped in corresponding data tables of the data model.  
The uniformization of the data collection process was initially performed by a \"true/false\" classification of the controls, which tends to make auditors perform round (and, in some way, binary) calculations during the control's analysis. A better uniformization was performed by applying a \"true/false\" classification to specific actions (i.e., some specific element to be checked) and grouping a set of actions for each control. This change gave more dynamicity to the calculation of the acceptance criteria, as is inferred from the actions' checklist, instead of the control itself. The mitigation tasks' list related to each control, which should be applied to those that did not fully pass, is provided to the auditors. The application associates this list to the auditing, which enables the possibility to report the mitigation tasks to the management board, for further implementations that may increase the compliance level of the corresponding control.  
The database mimics the overall concepts of an information security standard, namely its associated controls, actions' checklists, and mitigation tasks' list. The information system developed organizes the inputs by categories; each one is composed of controls, and each control has clauses. These entities represent the data template that will be presented to the auditors for a specific intervention.  
The platform was developed to deliver a customizable way to import the data entities previously described. These automatization and parameterization features allow the automatic importing and ingestion of these data entities from well-known structured formats, such as CSV. This format is easily adjustable to the checklist used by the information standard, and it can be imported automatically and applied in different scenarios.  
Therefore, the platform can be set to support different types of standards that follow the same correlation between controls and actions.  
Besides the standard entities imported from the CSV file, the data model incorporates other entities and their respective relationships, which are needed to store the auditing activity. As an example, the auditing interventions collect the controls validated by the auditor, which brings an additional management tool to evaluate and control the auditing as a whole. The entity Service Types addresses the two types of audits (Type 1 and Type 2) that were considered in our case study [24] and is described in Section 4.