The IACS must be audited regularly and documented in accord with the organization's audit procedures. The audit must examine whether the security policies and procedures are implemented in the IACS area and whether they meet the security objectives set for that area.
The scope of the audit should be defined before the audit is conducted and the frequency should be determined by the system criticality and risk assessments. The scope of the audit is usually determined by the owner of the system or process being audited, taking into account the system's risks and criticality.
The scope description should specify, at a minimum, the following:
- what is being audited (system, process, activity, etc.)
- the boundaries of the audit (what is included, what is excluded)
- audit objectives and period
