{"id":956,"date":"2009-10-19T07:00:17","date_gmt":"2009-10-19T15:00:17","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=956"},"modified":"2009-10-19T07:00:17","modified_gmt":"2009-10-19T15:00:17","slug":"compliance-security-assessment-versus-security-audit","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/compliance-security-assessment-versus-security-audit\/","title":{"rendered":"Compliance: Security Assessment versus Security Audit"},"content":{"rendered":"

Typically a security audit is one hurdle that needs to be cleared as part of a financial audit.\u00a0 There is a lot of talk about security audits and security assessments.\u00a0 But what’s the difference?\u00a0 A blog by Kevin Coleman<\/a> explains.<\/p>\n

Security assessments are internal checks that typically happen as a preliminary step prior to an audit.\u00a0 The assessment need not be formal, although formal processes like ISO 27000 specify in great detail what should be considered in the assessment.\u00a0 The assessment is a method for gathering data about current security measures and attempts to compare what the current situation is with how it should be.<\/p>\n

Security assessment data is collected using methods like:<\/p>\n

* Surveys
\n* Interviews
\n* Standards
\n* Statistics
\n* Record reviews<\/p>\n

The security audit, on the other hand, is a systematic evaluation of the company’s information system by comparing it to an established set of criteria.\u00a0 A security audit produces a written record of the results that document the system capabilities.\u00a0 The security audit typically satisifies the requirements of regulatory compliance like HIPAA and Saranes-Oxley.<\/p>\n

Coleman gives an example that illustrates the difference between the assessment and audit.\u00a0 The example he gives is authentication for access control.\u00a0 The assessment would check to see if\u00a0 the organization had a strong password policy in place, while the audit would actually test the system to see if the strong password policy is correctly implemented, probably by attempting to create a weak password.<\/p>\n

The result of a security assessment typically identifies items within a security policy that should be reconsidered or revisited.\u00a0 Ignoring suggestions from the assessment often lead to problems later when an audit is performed.\u00a0 There usually is no or little consequence with the failure of part of an assessment, but failure of an audit, especially when tied to compliance regulations, can bring stiff consequences.<\/p>\n

\n
\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Typically a security audit is one hurdle that needs to be cleared as part of a financial audit.\u00a0 There is a lot of talk about security audits and security assessments.\u00a0 But what’s the difference?\u00a0 A blog by Kevin Coleman explains.…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-956","post","type-post","status-publish","format-standard","hentry","category-compliance"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=956"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/956\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}