Control A.8.34Protection of information systems during audit testing

Audit tests and other assurance activities involving assessment of operational systems must be planned and agreed between the tester and appropriate management.

The control protects the systems from the assessment. Audit and assurance activity touches live systems — scanning, querying, extracting, sometimes testing controls actively — and each carries a risk of disruption or of exposing information to the assessor.

Planning and agreement means scope, timing, methods, the access the assessor needs, what may be extracted, how any data obtained is protected and returned or destroyed, and who is available if something goes wrong.

It applies to internal audit under clause 9.2, to independent review under A.5.35, to certification assessments, to penetration tests and to customer audits performed under a contractual right.

The read-only assumption is the one to examine. Assurance activity described as read-only routinely involves queries heavy enough to affect a production system, and agreeing a window and a rollback beforehand costs nothing compared with the outage that makes the assessment memorable for the wrong reason.