Audit & compliance

An audit verifies, with evidence, that controls exist and work as claimed. Compliance demonstrates to third parties (regulators, clients, certifiers) that requirements are met. One doesn’t imply the other: complying isn’t being secure, but a good audit brings the two closer.

Audit types

Internal    the organization reviews its own controls (improvement, pre-certification)
External    an independent third party audits (ISO certification, SOC 2...)
Certification  leads to a mark (ISO 27001, ENS) with a time validity
Regulatory  an authority verifies legal compliance (AEPD, sector supervisors)

Evidence and controls

- the audit is based on EVIDENCE: policies, logs, configurations, tickets, records
- design control (is it well defined?) vs operating effectiveness (does it work in practice?)
- sampling: samples from a period are reviewed (e.g. "were leavers' accesses revoked?")
- traceability: each framework requirement -> control -> evidence that demonstrates it

Certification/attestation frameworks

ISO 27001    ISMS certification (stage 1 and 2 audits, then annual surveillance)
SOC 2        attestation (AICPA) over service controls (Type I design / Type II effectiveness)
ENS          certification/conformity declaration for the public sector (Spain)
PCI DSS      mandatory compliance if handling payment card data

Compliance != security

- meeting a checklist does NOT guarantee being secure (can be "paper security")
- risk: optimizing to pass the audit instead of reducing real risk
- real security is validated with pentest/red team (offensive) and detection (blue team)
- the goal: that compliance REFLECTS controls that truly work

The audit cycle

1. plan (scope, criteria) 2. collect evidence 3. evaluate against requirements
4. findings (major/minor nonconformities, observations) 5. corrective action plan
6. follow-up (verify it was fixed) -> continuous improvement (PDCA)

Blue Team / GRC

Keep continuous evidence (logs, tickets, configs): the audit is easier if everything leaves a trail.
Seek operating effectiveness, not just design: controls must work day to day.
Avoid “paper security”: validate with pentest/red team and detection that what’s audited is real.
Manage nonconformities with corrective actions and follow-up (PDCA, see Frameworks (ISO 27001, NIST, ENS, CIS)).

Real cases and fines

Certified organizations that suffered breaches from controls that existed “on paper” but didn’t operate.
SOC 2 Type II as a common requirement to sell SaaS to enterprises (B2B).
PCI DSS mandatory for merchants/processors; non-compliance brings fines and loss of the payment gateway.

Testing checklist

Define the audit scope and criteria
Traceability requirement → control → evidence
Evaluate design AND operating effectiveness (not just design)
Collect continuous evidence (logs/tickets/configs)
Manage findings (nonconformities) and corrective actions
Validate that what’s audited is real (pentest/detection)
Follow-up and continuous improvement (PDCA)