Security Management Audit Work Program

This document outlines steps to audit an organization’s security management process.

Risk indicators include: no formal security vision, directives or policy endorsed by the client's senior or executive management regarding the protection of data assets; no formal security standards or procedures; responsibility and accountability for securing data assets has not been assigned; frequent unauthorized access to data or IT resources; and no formal monitoring of security logs to identify and address potential intrusions or inappropriate use of data assets.