Getting Started With

Cybersecurity

In this episode of Getting Started With, we break down cybersecurity fundamentals for internal auditors, including the difference between cybersecurity and information security and what the IIA’s Cybersecurity Topical Requirement asks you to assess. You’ll walk away knowing how to add real value on cyber topics without being a technical expert.

In this episode, you’ll learn:

The difference between cybersecurity and information security, using NIST definitions
Why cyber risk can appear in engagements that aren’t about cyber
How the Cybersecurity Topical Requirement covers governance, risk management, and controls
What incident response and recovery looks like, and why observing a tabletop exercise helps
How to approach cyber as an inspector, not a contractor, and why confidence is not evidence

Download the Cybersecurity Topical Requirement & User Guide

Watch next: Getting Started With: Third-Party Risk

New to internal auditing? Build a strong foundation with Tools for New Auditors! This course covers essential skills, industry best practices, and practical insights to help you succeed in the profession. Enroll today and take the first step in your internal audit journey!

View our Podcasts & Video page for more related content!

Chapters

Introduction [0:00]
What Cybersecurity Means: Protecting the Housez [0:32]
Internal Audit's Role: Inspector, Not Locksmith [0:54]
Key Terms: Cybersecurity vs. Information Security [1:21]
Why Cyber Risk Shows Up in Every Audit [2:36]
Useful Tools: The Cybersecurity Topical Requirement & User Guide [3:27]
Governance: The Household Plan [3:57]
Risk Management: Knowing Which Doors Are Weak [4:29]
Incident Response and Recovery [4:55]
Bright Idea: Observe a Tabletop Exercise [5:18]
Controls: The Locks [5:43]
Pro Tip: Assess the Process, Don't Rebuild It [6:22]
Building Competency: Confidence Is Not Evidence [6:41]
Wrap-Up & Next Steps [7:15]

00:00:03 The IIA

Hello, welcome to Getting Started With, where our job is to make your job easier.

00:00:08 The IIA

On this episode, we're getting started with cybersecurity fundamentals for internal auditors.

00:00:14 The IIA

In this video, you'll learn what cybersecurity means in an audit context, why cyber risk shows up in audits that aren't about cyber, what the cybersecurity topical requirement asks you to assess, and how to contribute without being a technical expert.

00:00:30 The IIA

So let's get started.

00:00:32 The IIA

Think about how you'd protect a house.

00:00:35 The IIA

You'd want to know what's inside worth protecting.

00:00:38 The IIA

You'd want to know who has keys.

00:00:40 The IIA

You'd want locks on the doors.

00:00:42 The IIA

And you'd want to know those locks work.

00:00:45 The IIA

And you'd want a plan for what happens if someone gets in anyway.

00:00:49 The IIA

That's cybersecurity.

00:00:51 The IIA

Same instincts, much bigger house.

00:00:54 The IIA

Here's a part that trips up a lot of new auditors.

00:00:57 The IIA

Internal audit is not the locksmith.

00:01:00 The IIA

We don't install the locks.

00:01:02 The IIA

The security team does that.

00:01:04 The IIA

And management decides which doors matter most.

00:01:08 The IIA

Internal audit is the person who checks whether the keys came back from the roommate who moved out last year.

00:01:15 The IIA

We don't build the protection, we give independent assurance that the protection is real.

00:01:21 The IIA

Which brings us to our first term to learn, cybersecurity.

00:01:26 The IIA

The cybersecurity topical requirement uses the definition from the National Institute of Standards and Technology, or NIST.

00:01:34 The IIA

Cybersecurity is the ability to protect or defend the use of cyberspace from cyber attacks.

00:01:41 The IIA

In plain terms, keeping attackers out of the systems your organization depends on.

00:01:47 The IIA

Our next term to learn is information security and the difference between the two matters.

00:01:53 The IIA

NIST defines information security as the protection of information and information systems, from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability, in plain terms, protecting the information itself, wherever it lives and wherever touches it.

00:02:19 The IIA

Cybersecurity is a subset of information security.

00:02:23 The IIA

Back to the house.

00:02:24 The IIA

Information security is everything in the house and how you handle it.

00:02:29 The IIA

Cybersecurity is mostly about the perimeter, the doors and the windows, and keeping out people who were never invited.

00:02:36 The IIA

Now, here's why this matters even if you never get assigned to a cybersecurity audit.

00:02:42 The IIA

Cyber risk doesn't stay in the IT audit.

00:02:45 The IIA

Cybersecurity touches almost every technological part of an organization.

00:02:50 The IIA

and is built into ordinary business processes too, which means it can show up in your engagement whether you plan for it or not.

00:03:00 The IIA

Cyber risk is part of your engagement risk assessment.

00:03:04 The IIA

Global Internal Audit Standard 13.2.

00:03:08 The IIA

Engagement risk assessment says internal auditors must develop an understanding of the activity under review to assess the relevant risks.

00:03:19 The IIA

That understanding is exactly what enables internal auditors to catch something they weren't even looking for.

00:03:27 The IIA

Here's a useful tool.

00:03:28 The IIA

Two of them.

00:03:29 The IIA

The Cybersecurity Topical Requirement and Cybersecurity Topical Requirement User Guide.

00:03:35 The IIA

The topical requirement itself is short.

00:03:38 The IIA

You can read it in about 10 minutes and you should.

00:03:41 The IIA

The user guide goes further.

00:03:42 The IIA

It has practical examples of when the requirement applies, that framework mapping we just talked about, and an optional printable

00:03:49 The IIA

form you can use to document your coverage of each requirement and your rationale for anything you excluded.

00:03:57 The IIA

Back to the house.

00:03:59 The IIA

The cyber security topical requirement covers governance, risk management, and controls.

00:04:05 The IIA

Governance is the household plan.

00:04:08 The IIA

Under the topical requirement, you are assessing whether a formal cyber security strategy exists and gets updated.

00:04:15 The IIA

whether the board is being told how it is going, whether policies are current, whether roles are clearly assigned, and whether the right people across the organization are talking to each other about threats.

00:04:29 The IIA

Risk management is knowing which doors are weak.

00:04:32 The IIA

It's identifying the threats, working out how bad each one would be, doing something about the serious ones, and then keeping watch.

00:04:42 The IIA

It's also about speed.

00:04:44 The IIA

The topical requirement asks whether a process exists to quickly escalate a cyber risk that reaches an unacceptable level.

00:04:52 The IIA

If the backdoor is broken, you fix it now.

00:04:55 The IIA

Our last term to learn sits inside risk management, incident response, and recovery.

00:05:01 The IIA

The topical requirement describes it as a process that includes detection, containment, recovery, and post-incident analysis.

00:05:10 The IIA

This process should be periodically tested.

00:05:13 The IIA

In plain terms,

00:05:14 The IIA

what you do when someone gets in anyway and prove you've practiced it.

00:05:18 The IIA

Here's a bright idea as to observe the next incident response tabletop exercise, which is a practice run where the team walks through a simulated incident step by step.

00:05:29 The IIA

Watching one will teach you more about how your organization really handles a breach than any policy document will.

00:05:37 The IIA

And it is a low pressure way for your auditor to build cyber knowledge.

00:05:43 The IIA

Controls are the logs.

00:05:45 The IIA

This is the part that sounds most technical and it is where new auditors get nervous.

00:05:51 The IIA

The cybersecurity topical requirement covers things like network controls, encryption, patching, user access management, and controls over e-mail, messaging, and file sharing.

00:06:03 The IIA

It also asks whether cybersecurity is considered across the whole life of an IT asset, from the day it is selected to the day it is thrown away.

00:06:13 The IIA

And it is not only your own locks, the requirement also covers vendor-based controls because a key you handed to someone else is still a key to your house.

00:06:22 The IIA

Here's a pro tip.

00:06:24 The IIA

You're assessing whether a process exists and works.

00:06:27 The IIA

You're not being asked to rebuild it, read the requirements, and notice how many begin the same way.

00:06:33 The IIA

A process is established, a formal strategy is established.

00:06:37 The IIA

That is an inspector's job, not a contractor's job.

00:06:41 The IIA

Standard 3.1 competency expects internal auditors to possess or obtain the competencies for their responsibilities.

00:06:50 The IIA

Notice the or obtain.

00:06:51 The IIA

Nobody expects a first year auditor to know all of this yet, which means cybersecurity is technical enough that it is tempting to accept a confident answer and move on.

00:07:03 The IIA

But confidence is not evidence, ask to see the policy.

00:07:08 The IIA

when it was last updated, as for the test results.

00:07:12 The IIA

That is not being difficult, that is the job.

00:07:15 The IIA

Thanks for watching Getting Started with Cybersecurity Fundamentals for Internal Auditors.

00:07:20 The IIA

If you want to go deeper, watch Getting Started with Third-Party Risk, since vendor controls are part of the cyber picture.

00:07:27 The IIA

Next, visit the IIA.org to download the cybersecurity topical requirement and its user guide, and keep building your knowledge, one lock at a time.