Senior ISMS Audit Expert

Expert-level Information Security Management System (ISMS) auditing with comprehensive knowledge of ISO 27001, security audit methodologies, security control assessment, and cybersecurity compliance verification.

Core ISMS Auditing Competencies

1. ISO 27001 ISMS Audit Program Management

Design and manage comprehensive ISMS audit programs ensuring systematic security evaluation and continuous improvement.

ISMS Audit Program Framework:

ISMS AUDIT PROGRAM MANAGEMENT
├── Security Audit Planning
│   ├── Risk-based audit scheduling
│   ├── Security domain scope definition
│   ├── Technical auditor competency
│   └── Security testing resource allocation
├── Audit Execution Coordination
│   ├── Technical security assessment
│   ├── Administrative control evaluation
│   ├── Physical security verification
│   └── Security documentation review
├── Security Finding Management
│   ├── Security gap identification
│   ├── Vulnerability assessment integration
│   ├── Risk-based finding prioritization
│   └── Security improvement recommendations
└── ISMS Audit Performance
    ├── Security audit effectiveness
    ├── Technical auditor development
    ├── Security methodology enhancement
    └── Industry best practice adoption

2. Risk-Based Security Audit Planning

Develop strategic security audit plans based on information security risks, threat landscape, and ISMS performance.

Security Audit Risk Assessment:

1. Information Security Risk Evaluation

   • Asset criticality and threat exposure analysis
   • Security control effectiveness assessment
   • Previous security incident and audit analysis
   • Decision Point: Determine audit priority and frequency based on security risk

2. Security Audit Scope Definition

   • High-Risk Assets: Quarterly technical security assessments
   • Critical Security Controls: Semi-annual control effectiveness testing
   • Standard Security Processes: Annual compliance verification
   • Emerging Threats: Event-driven security evaluations

3. Technical Security Testing Integration

   • Vulnerability assessment and penetration testing coordination
   • Security control technical verification
   • Threat simulation and red team exercises
   • Compliance scanning and automated testing

3. ISO 27001 Audit Execution and Methodology

Conduct systematic ISMS audits using proven methodologies ensuring comprehensive security assessment.

ISMS Audit Execution Process:

1. Security Audit Preparation

   • Pre-audit Security Review: Follow scripts/security-audit-prep.py
   • Technical Assessment Planning: Security testing scope and methods
   • Security Auditor Assignment: Technical competency and independence
   • ISMS Documentation Review: Policy, procedure, and control documentation

2. Security Audit Conduct

   • ISMS Process Assessment: Security management process evaluation
   • Security Control Testing: Technical and administrative control verification
   • Security Compliance Verification: Regulatory and standard compliance
   • Security Culture Assessment: Security awareness and training effectiveness

3. Security Audit Documentation

   • Security Finding Documentation: Technical and administrative findings
   • Risk Assessment Integration: Security risk impact and likelihood
   • Security Improvement Recommendations: Control enhancement and optimization
   • Compliance Status Reporting: ISO 27001 and regulatory compliance

4. Security Control Assessment and Testing

Conduct comprehensive security control assessments ensuring effective security implementation and operation.

Security Control Assessment Framework:

ISO 27002 CONTROL ASSESSMENT
├── Organizational Security Controls
│   ├── Information security policies
│   ├── Information security organization
│   ├── Human resource security
│   └── Asset management
├── Technical Security Controls
│   ├── Access control systems
│   ├── Cryptography implementation
│   ├── Systems security configuration
│   ├── Network security controls
│   ├── Application security measures
│   └── Secure development practices
├── Physical Security Controls
│   ├── Physical security perimeters
│   ├── Physical entry controls
│   ├── Equipment protection
│   └── Secure disposal procedures
└── Operational Security Controls
    ├── Operational procedures
    ├── Change management
    ├── Capacity management
    ├── System segregation
    ├── Malware protection
    └── Backup and recovery

Advanced ISMS Audit Applications

Technical Security Testing Integration

Integrate technical security assessments with ISMS auditing ensuring comprehensive security verification.

Technical Security Assessment:

1. Vulnerability Assessment Integration

   • Network vulnerability scanning and analysis
   • Application security testing and code review
   • Configuration assessment and hardening verification
   • Decision Point: Determine technical testing scope based on risk and compliance

2. Penetration Testing Coordination

   • For External Networks: Follow references/external-pentest-guide.md
   • For Internal Systems: Follow references/internal-pentest-guide.md
   • For Web Applications: Follow references/webapp-security-testing.md
   • Social engineering and phishing simulation

3. Security Control Verification

   • Access control effectiveness testing
   • Encryption implementation verification
   • Monitoring and logging system assessment
   • Incident response procedure validation

Cybersecurity Compliance Auditing

Conduct specialized cybersecurity compliance audits addressing regulatory and industry requirements.

Cybersecurity Compliance Framework:

• Healthcare Cybersecurity: HIPAA Security Rule and healthcare-specific requirements
• Medical Device Cybersecurity: FDA cybersecurity guidance and IEC 62304 integration
• Financial Services: PCI DSS and financial industry security standards
• Critical Infrastructure: NIST Cybersecurity Framework and sector-specific guidelines

Cloud Security Auditing

Assess cloud security implementations ensuring comprehensive cloud service security verification.

Cloud Security Audit Approach:

1. Cloud Service Provider Assessment

   • CSP security certification and compliance verification
   • Shared responsibility model implementation review
   • Data residency and sovereignty compliance
   • Cloud access and identity management assessment

2. Cloud Configuration Assessment

   • Cloud resource configuration and hardening
   • Network security and segmentation verification
   • Data encryption and key management assessment
   • Cloud monitoring and logging evaluation

Security Auditor Competency and Development

Security Auditor Technical Competency

Develop and maintain security auditor technical competency ensuring effective security assessment capabilities.

Security Auditor Competency Framework:

SECURITY AUDITOR COMPETENCY
├── Technical Security Knowledge
│   ├── Network security and protocols
│   ├── System security and hardening
│   ├── Application security and testing
│   ├── Cryptography and key management
│   └── Security architecture and design
├── Security Assessment Skills
│   ├── Vulnerability assessment techniques
│   ├── Penetration testing methodologies
│   ├── Security control testing
│   └── Risk assessment and analysis
├── Compliance and Standards
│   ├── ISO 27001/27002 expertise
│   ├── Regulatory requirement knowledge
│   ├── Industry standard familiarity
│   └── Audit methodology proficiency
└── Communication and Reporting
    ├── Technical finding documentation
    ├── Risk communication skills
    ├── Executive reporting capabilities
    └── Stakeholder engagement

Security Audit Tool Proficiency

Maintain proficiency with security audit tools and technologies ensuring effective technical assessment.

**