An independent ISMS internal audit, delivered entirely remotely, gave a global data centre operator assurance that its certified information security management system was well managed and ready for external surveillance audits.
THE CHALLENGE
A global data centre operator provides data centre and interconnection services to organisations across a wide range of industries and acts as custodian of business-critical data for its customers. To demonstrate its commitment to security assurance, it maintains an information security management system (ISMS) certified to ISO/IEC 27001. Maintaining certification requires an annual internal audit that verifies security controls are operating effectively and identifies improvement opportunities ahead of external surveillance audits. Circumstances at the time meant the entire audit had to be conducted remotely. The operator needed a trusted, independent partner who could deliver a rigorous assessment through virtual means without compromising the quality or integrity of the audit process.
OUR APPROACH
Agilient was engaged to perform the independent internal audit of the operator’s ISMS and adapted its audit methodology for fully remote delivery using secure videoconferencing. The audit began with a review of the ISMS documentation, including policies, procedures and records of operation. Agilient’s auditors then held detailed virtual interviews and screen-sharing sessions with key personnel to examine evidence and validate the implementation and effectiveness of controls against ISO/IEC 27001. The scope covered the key elements of the management system, from security policy and risk management to access control, operations security and incident management. Screen-sharing allowed auditors to sight records and system evidence directly rather than relying on descriptions alone. The engagement showed that Agilient’s audit method could be adapted to remote delivery while maintaining the level of assurance expected of an internal audit.
THE OUTCOME
Management received independent validation of its management system and was well prepared for its external surveillance audits.
- A formal internal audit report that identified no major non-conformances
- Confirmation that the system was well managed and resourced with knowledgeable, capable staff
- Minor improvement recommendations, such as stronger version control on key documents
Related services: security audit services, security risk assessment consultants. Sector experience: critical infrastructure security consultant. To discuss a similar project, contact Agilient.