How Do I Prepare for a Cyber Security Audit?

Quick answer: Start early, document everything, gather evidence before the auditor asks, and fix obvious gaps beforehand. Auditors want to see that security is genuinely managed, not just that policies exist. Show them a living programme, not a paper exercise.

Types of Cyber Security Audits

Certification audits

ISO 27001, Cyber Essentials Plus

• Formal assessment against defined standards
• Pass/fail outcome
• Certificate issued if successful
• Conducted by accredited auditors

Customer/supplier audits

Third-party assessments

• Customer verifying your security
• Often questionnaire-based
• May include site visits
• Pass means keeping the contract

Internal audits

Self-assessment

• Testing your own controls
• Required by ISO 27001
• Identifies gaps before external audit
• Demonstrates continuous improvement

Regulatory audits

Compliance verification

• Sector regulator checking requirements
• FCA, ICO, sector-specific bodies
• Can be triggered by incidents
• May result in enforcement action

What Auditors Look For

Evidence, not just claims

"Show me, don't tell me"

• Policies exist AND are followed
• Controls are implemented AND working
• Training happened AND people learned
• Incidents were handled AND lessons learned

Consistency

Does reality match documentation?

• Policy says X, is X actually happening?
• Process defined, but is it followed?
• Controls documented, but are they active?

Management engagement

Is leadership involved?

• Management reviews happening
• Security discussed at board level
• Resources allocated
• Accountability clear

Continuous improvement

Are you getting better?

• Issues identified and fixed
• Lessons learned from incidents
• Regular reviews and updates
• Trends improving

Preparation Timeline

3+ months before

Documentation review:

• Policies current and approved?
• Procedures documented?
• Records maintained?
• Evidence organised?

Gap assessment:

• Pre-audit internal review
• Technical controls verified
• Process compliance checked
• Obvious gaps fixed

Assign responsibilities:

• Who's point of contact?
• Who provides evidence for each area?
• Who answers technical questions?

1 month before

Evidence gathering:

• Screenshots of configurations
• Training records
• Patch reports
• Access reviews
• Incident logs
• Meeting minutes

Final gap closure:

• Address any remaining issues
• Document anything you can't fix and why
• Prepare compensating control explanations

Logistics:

• Room booked
• Systems access for auditor
• Key people available
• Refreshments (auditors are human)

Week before

Brief your team:

• Who might be interviewed
• What to expect
• Be honest (auditors spot evasion)
• Refer complex questions to experts

Final check:

• Evidence package complete
• Systems accessible
• Documentation current
• Key contacts confirmed

Common Audit Failures

Documentation gaps

• Policy says quarterly reviews, no evidence of reviews
• Training required, no completion records
• Access review policy, no review documentation

Fix: Create evidence as you go, not before audits.

Configuration vs policy mismatch

• Password policy says 12 characters, system allows 8
• MFA required, exceptions exist
• Patching within 14 days, 90-day backlog exists

Fix: Actually implement what your policies say.

Missing management engagement

• No management review minutes
• Security not in board reporting
• No evidence of resource allocation

Fix: Involve management genuinely, document it.

Poor incident records

• Incidents happened but not documented
• No lessons learned
• Same issues recurring

Fix: Document incidents as they happen, including learning.

During the Audit

Do:

• Be honest (they'll find issues anyway)
• Say "I don't know, let me find out" if needed
• Provide evidence promptly
• Be professional and cooperative
• Take notes on findings

Don't:

• Guess or make things up
• Argue with findings
• Blame others
• Hide problems
• Make promises you can't keep

After the Audit

Address findings promptly:

• Create action plan for each finding
• Assign owners and deadlines
• Track to completion
• Evidence the fix

Learn from the experience:

• What surprised you?
• Where were you weak?
• What needs ongoing attention?

Maintain readiness:

• Don't let documentation slip
• Keep evidence current
• Prepare throughout the year

How We Help

We support clients through audits:

Preparation:

• Gap assessments
• Documentation review
• Evidence gathering
• Pre-audit remediation

During audit:

• Technical support
• Evidence provision
• Query response

After audit:

• Remediation planning
• Finding closure
• Ongoing compliance

Being audit-ready all year beats cramming before audits.

---

about preparation support.

---