Information security audit

An information security audit is an <a href="/facts/Audit/u8mr4Xsd">audit</a> of the level of <a href="/facts/Information_security/horlrCln">information security</a> in an organization. It is an independent review and examination of system records, activities, and related documents. These audits are intended to improve the level of information security, avoid improper information security designs, and optimize the efficiency of the security safeguards and security processes. 
Within the broad scope of auditing information security there are multiple types of audits, multiple objectives for different audits, etc. Most commonly the <a href="/facts/Internal_control/jMcXFBMm">controls</a> being audited can be categorized as <a href="/facts/Technology/9Uav5WVR">technical</a>, physical and <a href="/facts/Business_administration/Sj3A56z1">administrative</a>. Auditing information security covers topics from auditing the physical security of data centers to auditing the logical security of databases, and highlights key components to look for and different methods for auditing these areas.
When centered on the <a href="/facts/Information_technology/glMzunwe">Information technology</a> (IT) aspects of information security, it can be seen as a part of an <a href="/facts/Information_technology_audit/v2w8GFhf">information technology audit</a>. It is often then referred to as an information technology security audit or a computer security audit. However, information security encompasses much more than IT.

Information security audit open-in-new

Information security audit