How do we defend our prioritisation method to an auditor?

Start

An auditor will test how we prioritise findings

Under ISO/IEC 27001 an auditor usually tests two things. First, that you have defined criteria for judging risk that give consistent, comparable results when applied again (clause 6.1.2). Second, that you evaluate your exposure to technical vulnerabilities and act in proportion to it (Annex A 8.8). A defence has to show both.

• Then: Is the method written down and approved?

Decision

Is the method written down and approved?

The auditor needs a document to test against: the approved standard with its deadlines, and the rating method that assigns each finding a priority. Ranking by the scanner's severity alone, or by judgement in a meeting, cannot be re-derived. If approval records cannot be found, answer no.

• Yes: Gather the evidence the auditor will ask for
• No, or not known: Write and approve the method before you defend it

Outcome

Write and approve the method before you defend it

Adopt a written method that asks whether the weakness is being exploited, whether an attacker can reach the system, how severe it is, and how much the system matters. Before approval, rate your last three months of findings with it and check how many would have missed their deadline. Then apply it for a period, so there are records to test.

Step

Gather the evidence the auditor will ask for

Five things: the approved standard and method, with matching deadlines; the findings record showing each finding's four inputs, priority, deadline, first-detection date and closure evidence; every raise and lowering, with who decided and why; the calibration record; and reports of deadline adherence by priority. If the method and the standard disagree on a deadline, the standard wins and the method is corrected.

• Then: Re-derive a random sample of priorities yourself

Step

Re-derive a random sample of priorities yourself

Pick findings at random from your records; the pack's default is 10. For each, take the recorded inputs and read the priority again from the method's table. Do this every quarter, so the first run is not in front of the auditor. It is the same test you will invite the auditor to run.

• Then: Does every re-derived priority match the recorded one?

Decision

Does every re-derived priority match the recorded one?

A match shows the method is applied the same way each time. A finding whose inputs were not recorded cannot be re-derived, so count it as a mismatch.

• Yes: Are the deadlines met, and is adherence reported?
• No: Is each difference a recorded raise or lowering?

Decision

Is each difference a recorded raise or lowering?

A difference is acceptable when the record shows why. A raise needs the reason. A lowering needs the standard owner's decision, the reason, and a control that changed one of the inputs. A lowering made to avoid a missed deadline is not a valid explanation. If the record is silent, answer no.

• Yes: Are the deadlines met, and is adherence reported?
• No, or not known: Find why it differs, correct it, and test again

Step

Find why it differs, correct it, and test again

Look for an input recorded wrongly, a tool or spreadsheet that applies the table incorrectly, a definition that two people read differently, or a change nobody recorded. Correct the record and the cause. Check any tool against the method's calibration test cases, and have two people rate the same findings to expose unclear wording.

• Then: Re-derive a random sample of priorities yourself (back to an earlier step)

Decision

Are the deadlines met, and is adherence reported?

Auditors ask whether the deadlines are achievable. The method's answer is that they were tested against real findings before approval and adherence is reported regularly. The pack's quarterly signal is a priority consistently below 90% adherence. If adherence is not measured, answer no.

• Yes: State the method's limits and how each is managed
• No, or not known: Show what was decided about the missed deadlines

Step

Show what was decided about the missed deadlines

Show the adherence figures, the overdue escalations and what was decided about them: more capacity, longer deadlines approved in the standard, or exceptions. A priority is never lowered to rescue a deadline, so a lowering recorded after a missed deadline will stand out in the re-derivation test.

• Then: State the method's limits and how each is managed

Step

State the method's limits and how each is managed

Exploitation sources lag. CVSS scores ignore context. Two exposure levels simplify reality. Everything depends on the asset inventory. Findings are rated one at a time, so a chain of Medium flaws can be missed. Deadlines do not reflect effort. For each, say how you manage it, for example unknown exposure and criticality default to the more urgent value. An auditor is more reassured by stated limits than by none.

• Then: Prepare answers to the questions auditors usually ask

Step

Prepare answers to the questions auditors usually ask

Why not fix by CVSS score? How do you know a weakness is exploited? Who can change a priority, and how is that controlled? Are the deadlines achievable? Does this meet payment card requirements? Each answer should point to a rule in your method and a record that shows it applied.

• Then: Has a calibration review been recorded this quarter?

Decision

Has a calibration review been recorded this quarter?

The quarterly review looks at the spread of findings across priorities, deadline adherence, how often priorities were raised or lowered, findings later exploited while rated low, inputs that were defaulted because they were unknown, and the re-derivation test. The pack lets a small organisation run these checks every six months instead. If there is no record within your cycle, answer no.

• Yes: Invite the auditor to re-derive priorities themselves
• No, or not known: Run and record a calibration review before the audit

Outcome

Run and record a calibration review before the audit

Run the quarterly checks now and record the date, who reviewed, the findings sampled, the mismatches found and any change proposed. A recent record, even the first one, answers the auditor's question of whether the method is monitored.

Outcome

Invite the auditor to re-derive priorities themselves

You have a written method, evidence it is applied consistently, figures showing the deadlines are met or managed, and a record that it is reviewed. Offer the auditor the re-derivation test on a sample they choose. It is the strongest defence the method has.