Content library
ISO 27001 (2022): Full
8.34: Protection of information systems during audit testing

Requirement description

To minimize the impact of audit and other assurance activities on operational systems and business processes, it's crucial to plan and agree on these activities between the tester and appropriate management. Guidelines for this include controlling the scope of technical tests, and limiting tests to read-only access whenever possible. Audit tests that could affect system availability should be scheduled outside business hours, and all access should be monitored and logged for audit purposes.

How to fill the requirement

ISO 27001 (2022): Full

8.34: Protection of information systems during audit testing

Task name
Priority
Status
Theme
Policy
Other requirements
Protection of data systems during audit-related testing
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
System management
Data system management
2
requirements

Examples of other requirements this task affects

8.34: Protection of information systems during audit testing
ISO 27001
5.2.6: IT System Management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Protection of data systems during audit-related testing
1. Task description

Reviews and other verification actions e.g. during audits, that target data systems, must be planned in advance and agreed with the appropriate testers and management. This aims to minimize the impact of actions on operational processes.

When planning practices, the following points must be taken into account:

  • inspection requests are approved with the appropriate responsible person
  • the scope of technical tests is agreed in advance and their the implementation is monitored
  • tests are restricted to read-only use as far as possible or are only implemented by experienced system administrators
  • fulfilment of security requirements is ensured in advance on devices that require access to systems
  • tests that may affect the availability of important systems, are performed outside office hours
  • the actions taken during the inspections and the access rights granted for them are recorded in a log

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.