38

Information Security Audit Guidance

Embed Size (px)

Citation preview

Page 1: Information Security Audit Guidance

����������������� ��� ��� ���������� ��������������������������������� !"""#$%&'()*'*+*,#-./ �0!123�0!456478��0!�69�6�

Page 2: Information Security Audit Guidance

�������������� �������

Page 3: Information Security Audit Guidance

��������������� ������������������������������������������ !�����"������#$�%&!���'������ !�����"������#�(!�!)� ���*$�%&!��+����&��,���-��'��������� !�����"������#�.�/&��+������'0�1��'2��������������� !�����"������#�3�%&#�+����*4�%&���'�5�'2��'�67����������� !�����"������#*� 8�(!�!)� ���0'�5�7������&��+�����1����''� 9�%&!��+������'�%!���/��"��� 9�+������'�:�;��<<<� 9�+������'�=��0��:�;��<<<>�?���@� 2!���'�A��!��������7#�������������!77#B�?�72����?������+������'>�%&��"&��7��/!7;�����&��+������'*CD������ !�����"������#�+�����@&��;7�'��EF+�����17!����)�EF+�����/�'���)� ���+�����/�'���)�1����''�'� ���+�����/�'���)�"��2'� �GF@�����7'���������� !�����"������#$EF+�����5�2�����)�C�1��2!���)�����!��+����� �@� ����!���)����&�+������'���+22������'H��&���5�'�����'+77���'�)���7� ���'I������� !����I�!�����������!�����2#��)&��J�GEEK��/�@� 27�!������'������I�!�����'���������E4�(���!I����<I���7�''���&����'�������<�+77���)&�'�!�����'����������!77���2#��)&��&�7���'<L��2!�������&�'�2�67��!����� !#�6����2�������I�'���������!��������!7�'#'�� I������!�' ���������!�#���� ����6#�!�#� �!�'I��7��������I� ��&!���!7I�2&�����2#��)I���������)I�'�!����)I������&����'�I�����2��!'�2�� ������������M��E8�����E9�����&���>8K�N������"�!��'�@�2#��)&��+��I����&�����&��2�������������2�� �''��������&����2#��)&��&�7���<�:� ������:�!6�7��#O=�'�7!� ������%!��!��#P�%&�7���&����2#��)&��&�7���'I�2�67�'&��'I�!���!��&��'�&!����'����&����6�'��������'����2��2!���)��&�'����;I��&�#� !;�������2��'���!����'�����!��!����'����&���'2��������&��!����!�#������ 27�����''�����&���������'�����&�'�6��;�!���'2���-��!77#���'�7!� �!�#�� 27�����!��!����'���� ���&!��!6�7��#����-����''�����!�2!�����7!��2��2�'�<�L���!��!��#� !#�6�����!����������������6#�'!7�'���2��'���!����'������������'!7�'� !����!7'<�/&��!������!���'��!��)��'�����!�����&������ !#�����6���'!67������#����'���!����<�Q���'&��7�����'�7�����&�!�2����''���!7��&����!22��2��!��<�L���&����&��2�67�'&��'�����!��&��'�'&!77�6��7�!67������!�#�7�''����2��-������!�#���&����� ����!7��! !)�'I����7����)I�6�������7� �������I�'2���!7I���������!7I����'�R�����!7I������&����! !)�'<+77���!�� !�;'�������&������!����&��2��2���#�����&������'2������������'<S��TUVS��WXYZS[��[X\SX[S��] ��_��[�a]_�bcdefghgijhklhmenopqrstjhksugqgfgjvwxyzvy{|}~�����xyz�������xy�zv{��y�����x�y�|y�xy�y��|���y���w|����y|�y�wxy�|�xy|�y�x�w�|�|��y��y�����x��y�|�x�����xy���y�x�����|��y�|}~�����x�yvw�|��wy�|}~�xwx����xyx������|��y�x�x���w�y���y��������y�x���x�y�|yx}x�����y�|�x��}x��y������x�y���y���x��x�y�����x��y���y�x�w�|�|��y~������x��y�xywx�~y|���������|��y|�x��|}xy�wxy�w���x��x�y~|�x�y��y�|�����y�x�����|��yx����|�}x��y���y�y��y�x�y����y�|y����y�|}~�����xyx��|���y���|y��~����y|~~|�������x��zv{���y~��}���y�|��y��y�|y�xy�y��x���y���y�����x�y�x�|���xy�|�yzvy~�|�x���|����y�xx����y�|ywx�~y�����x��x�y}xx�y~�������y�x�������y�y�������y���|�����������y���y|�wx�y�x�����|��y�x����x}x����yv���x�x�y��y{z���y{v���y�|}~�����xy}����x���y���y���|�}���|�y�x�w�|�|��y~�|�x���|�����yzv{�y�|���x�y|�y�x��|����y���y�x��������~x���y�y���|�}���|�y�w��y~�|}|�x�y����x�x��y���y~�|~����x�y�x��y~������x�y���w��y�wxyzvy�|}}�������e�hne�jhqs�e�nrgqes�hopjrujh�quqg�h   ¡qgtqsugqgfgj¡ten{|}}x���y���y����x���|��y�|y�}~�|�xy�wxyzvy¢����y{wx�������y��xy������yx��|����x��y£�x��xy�x��y�|��y�x�|}}x�����|��y�|yx���|�¤�����������x��|}�y����zv{��������x��|}

Page 4: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./01,231,410,56789:;<:97=:;>:?@AB9:C7=DEFB<9:G=HB=<I:�J%K��� K��KL$M #K�J%&NO "#"KPQ%KPK"%Q %"K'RK#'S &POKSPS%Q"K#JP#KSQ'T M%KSQP&# &POKU$ MP!&%KR'QK��VK&'(SO WP!&%VKP!MKX$" !%""K(P!PU%Q"K'!KSQ%SPQ !UKR'QK"$&&%""R$OK !#%Q!POKP$M #"K'RKTPQ '$"KP"S%&#"K'RK#J% QK'S%QP# '!"�K�!KPMM # '!K#'KJ%OS !UK(P!PU%Q"K$!M%Q"#P!MK�JP#KP$M W#'Q"KO''NKR'QKP!MK�JYVK#J%K��KL$M #K�J%&NO "#"K&P!KJ%OSK(P!PU%Q"KSQ'P&# T%OYK&'(SO%#%K"%ORKP""%""(%!#"K'RK#J% QK'S%QP# '!"VK#J%Q%XYK M%!# RY !UK'SS'Q#$! # %"KR'QK"Y"#%(KP!MKSQ'&%""K (SQ'T%(%!#"K#JP#K&P!KX%KS%QR'Q(%MK !KPMTP!&%K'RKP!KP&#$POKP$M #�6789:B<:97B<:Z8Z=H:8[\@9I:�J "KSPS%QVK]��KL$M #K�J%&NO "#K�!R'Q(P# '!K_%&$Q #YVK"$SWS'Q#"KP!K !#%Q!POKP$M #K'RK#J%K'QUP! aP# '!b"K !R'Q(P# '!K"%&$Q #YKSQ'UQP(K� #JKU$ MP!&%K'!K (SQ'T !UK !R'Q(P# '!K"%&$Q #YKSQ'UQP("KP!MKSQ'&%""%"VKP"K�%OOKP"K !R'Q(P# '!K'!KP""%"" !UK#J%KQ'X$"#!%""K'RKY'$QK'QUP! aP# '!b"K"%&$Q #YK%RR'Q#"�K�J%KSPS%QK "K !#%!M%MK#'KJ%OSK��VK&'(SO P!&%VKP$M #VKP!MKX$" !%""K(P!PU%Q"KSQ%SPQ%KR'QKP!KP$M #K'RK !R'QW(P# '!K"%&$Q #YKP!MVK$O# (P#%OYVK#'K%!"$Q%K#JP#K#J%KP$M #K%cS%Q %!&%KP!MKQ%"$O#"KPQ%KP"KSQ'M$&# T%KP"KS'"" XO%�d8Z=H:C\e9=e9<fKL&&'QM !UK#'K#J%K�!R'Q(P# '!K_%&$Q #YKg'Q$(VK"%&$WQ #YK(P!PU%(%!#K(%P!"K]N%%S !UK#J%KX$" !%""KQ "N"KP""'& P#%MK� #JK !R'Q(P# '!K"Y"#%("K$!M%QK&'!#Q'OK� #J !KP!K%!#%QSQ "%�Kh%i$ Q%(%!#"KR'QK"%&$Q #YK(P!WPU%(%!#K !&O$M%K]&O%PQKM Q%&# '!KP!MK&'(( #(%!#KRQ'(K#J%K#'SVK#J%KPOO'&P# '!K'RKPM%i$P#%KQ%"'$Q&%"VK%RR%&# T%KPQQP!U%(%!#"KR'QKSQ'('# !UKU''MK !R'Q(PW# '!K"%&$Q #YKSQP&# &%K#JQ'$UJ'$#K#J%K%!#%QSQ "%VKP!MK#J%K%"#PXO "J(%!#K'RKPK"%&$Q%K%!T Q'!(%!#�jK fK�J%K !R'Q(P# '!K"%&$Q #YKSQ'UQP(K "KPK&Q # &POK&'(S'W!%!#K'RK%T%QYK'QUP! aP# '!b"KQ "NK(P!PU%(%!#K%RR'Q#VKSQ'T M !UK#J%K(%P!"K#'KSQ'#%&#K#J%K'QUP! aP# '!b"K !R'Q(P# '!KP!MK'#J%QK&Q # &POKP""%#"�fKLK�%OOW(P!PU%MK !R'Q(P# '!K"%&$Q #YKSQ'UQP(KJP"KQ'X$"#KSOP!"VKSQ'&%M$Q%"VKU'PO"VK'Xk%&# T%"VK#QP !%MK"#PRRVKS%QR'Q(P!&%KQ%S'Q# !UVKP!MK'!U' !UK (SQ'T%W(%!#K%RR'Q#"�K�J%KP$M #K#%P(KO''N"KR'QK%T M%!&%K#JP#K#J%K !R'Q(P# '!K"%&$Q #YKSQ'UQP(K "K�%OOK'QUP! a%MKP!MK�%OOK(P!PU%M�K�J%K"%&$Q #YKSQ'UQP(K($"#KPO"'K"S%& lK&POOYK( # UP#%KQ "N"K !K"P# "RY !UKN%YKX$" !%""K'Xk%&# T%"VKP!MK#J "K#QP&%PX O #YK($"#KX%K&O%PQ�KfKm'$QK !R'Q(P# '!K"%&$Q #YKP$M #K"J'$OMK&'!lKQ(K#JP#KN%YKQ "N"K#'K#J%K'QUP! aP# '!KPQ%K M%!# lK%MVK('! W#'Q%MVKP!MK&'!#Q'OO%MnK#JP#KN%YK&'!#Q'O"KPQ%K'S%QP# !UK%RR%&# T%OYKP!MK&'!" "#%!#OYnKP!MK#JP#K(P!PU%(%!#KP!MK"#PRRKJPT%K#J%KPX O #YK#'KQ%&'U! a%KP!MKQ%"S'!MK#'K!%�K#JQ%P#"KP!MKQ "N"KP"K#J%YKPQ "%�fKL$M #"KP!MKQ%T %�"K'RKY'$QK !R'Q(P# '!K"%&$Q #YKSQ'UQP(KP!MK #"K(P!PU%(%!#KPMTP!&%K#J%KU'POK'RKSQ'UQP(K'T%Q" UJ#KP!MK%!"$Q !UK&'!# !$'$"K (SQ'T%W(%!#KP!MK"$&&%""�fK�J%K !R'Q(P# '!K"%&$Q #YKP$M #b"KU'PO"VK'Xk%&# T%"VK"&'S%VKP!MKS$QS'"%K� OOKM%#%Q( !%K�J &JKP&#$POKP$M #KSQ'&%M$Q%"KP!MKi$%"# '!"KY'$QK'QUP! aP# '!KQ%i$ Q%"�K�J "KM'&$(%!#KSQ'T M%"KPKR'$!MP# '!POK��KP$M #K&J%&NWO "#KY'$K&P!K$"%KP!MK('M RYK#'KlK#KY'$QK"S%& lK&K" #$P# '!�KfKLMM # '!POKQ%"'$Q&%"K#JP#K&'(SO%(%!#K#J%K&'!#%!#K'RK#J "KSPS%QKPQ%KSQ'T M%MK !K#J%KPSS%!M &%"�joopqrstrutovwoxvvtoyurzq{z|owvuo}swvu~rq{vsop|z�u{q��o�|�u�ru�o�����o}swvu~rq{vsop|z�u{q�o�vu�~�o�qq��������{�w�|z�u{q��qrstrut�zv~�{st|��{|��q~

Page 5: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./01.-+1.21314.-5.67.837609,-:63.;1<=0:->?.@!A !B'C(D# '!A"%&$C #EA(D!DF%(%!#AGC'FCD(A "A!%&%"H"DCEAI%&D$"%A#JC%D#"A#'A#J%ADKD LDI L #EMA !#%FC #EMAD!NA&'!OAN%!# DL #EA'BA#J%A'CFD! PD# '!Q"A !B'C(D# '!ADC%AFC%D#AD!NMADGGDC%!#LEMA%K%CA !&C%D" !F�A@LLA&'(GD! %"AG'""%""A !B'C(D# '!A#JD#A "A&C # &DLA'CA"%!" # K%MACD!F !FABC'(AG%C"'!DLAND#DA#'AOA!D!& DLAD!NAGC'N$&#A !B'C(D# '!AD!NA&$"#'(%CMAICD!NMAD!NA�RA !B'C(D# '!�A@!A !B'C(DH# '!A"%&$C #EAGC'FCD(A (GL%(%!#"AGC'#%&# K%A(%D"$C%"A#'A%!"$C%A&'CG'CD#%A !B'C(D# '!A "A!'#A LL & #LEA'CA (GC'GH%CLEAD&&%""%NMA('N OA%NMA'CA$"%N�A�J%AI%!%OA#"A'BAD!A%BB%&# K%A !B'C(D# '!A"%&$C #EAGC'FCD(A !&L$N%SAT�A�J%ADI L #EA#'A"E"#%(D# &DLLEAD!NAGC'D&# K%LEAGC'#%&#A#J%A&'(GD!EABC'(A#J%AND!F%C"AD!NAG'#%!# DLA&'"#"A'BA&'(G$#%CA( "$"%AD!NA&EI%C&C (%U�A�J%ADI L #EA#'A(DV%A !B'C(%NMAGCD&# &DLAN%& " '!"ADI'$#A"%&$C #EA#%&J!'L'F %"AD!NA"'L$# '!"AD!NA#J$"A !&C%D"%A#J%AC%#$C!A'!A !B'C(D# '!A"%&$C #EA !K%"#(%!#"W�A�J%A(D!DF%(%!#AD!NA&'!#C'LA'BA&'"#"AC%LD#%NA#'A !B'C(D# '!A"%&$C #EX�AYC%D#%CA'CFD! PD# '!DLA&C%N I L #EA� #JA"#DBBMA&$"#'(%C"MAD!NAGDC#!%CA'CFD! PD# '!"Z�A[%##%CA&'(GL D!&%A� #JAC%F$LD#'CEAC%\$ C%(%!#"AB'CA"%&$C #EAD!NAGC KD&EA]�A�(GL%(%!#D# '!A'BAI%"#AGCD&# &%"A !AC "VA(D!DF%(%!#A !AC%FDCNA#'A !B'C(D# '!AD""%#"AD!NA"%&$C #EA_abcdefb_gbg_hbaijfb_gkledafmnK%CA#J%AGD"#AB%�AE%DC"MA#J%A (G'C#D!&%A#'A&'CG'CD#%AF'K%C!D!&%A'BA%BB%&# K%LEA(D!DF !FAC "VAJD"AI%&'(%A� N%LEAD&&%G#%N�A�J%A !B'C(D# '!A"%&$C #EAGC'FCD(A "ADA&C # &DLA&'(G'!%!#A'BA%K%CEA'CFD! PD# '!Q"AC "VA(D!DF%H(%!#A%BB'C#AD!NAGC'K N%"A#J%A(%D!"AB'CAGC'#%&# !FA#J%A'CFD! PD# '!Q"AN F #DLA !B'C(D# '!AD!NA'#J%CA&C # &DLA !B'C(D# '!AD""%#"�Ao #JA#J%A !&C%D"%NA (G'C#D!&%A'BA#J%A !B'C(D# '!A"%&$C #EAGC'FCD(A !AGC'#%&# !FA"%!" # K%A&'CG'CD#%AD!NAG%C"'!DLA !B'C(D# '!MA#J%A !#%C!DLAD$N #AB$!&# '!AJD"A !&C%D"%NA#J%ABC%\$%!&EAD!NA&'(GC%J%!" K%H!%""A'BA #"AD""%""(%!#A'BA !B'C(D# '!A"%&$C #EAGC'&%""%"AD!NA%BB'C#"�A*+,-.85.837609,-:63.;1<=0:->.p,3,q1913-?@&&'CN !FA#'A#J%A�!B'C(D# '!Ar%&$C #EAs'C$(MA"%&$C #EA(D!DF%(%!#A(%D!"AtV%%G !FA#J%AI$" !%""AC "V"AD""'& HD#%NA� #JA !B'C(D# '!A"E"#%("A$!N%CA&'!#C'LA� #J !AD!A%!#%CGC "%�uAv%\$ C%(%!#"AB'CA"%&$C #EA(D!DF%(%!#A !&L$N%At&L%DCAN C%&# '!AD!NA&'(( #(%!#ABC'(A#J%A#'GMA#J%ADLL'&D# '!A'BADN%\$D#%AC%"'$C&%"MA%BB%&# K%ADCCD!F%H(%!#"AB'CAGC'('# !FAF''NA !B'C(D# '!A"%&$C #EAGCD&# &%A#JC'$FJ'$#A#J%A%!#%CGC "%MAD!NA#J%A%"#DIL "J(%!#A'BADA"%&$C%A%!K C'!(%!#�uTA@!A%BB%&# K%A !B'C(D# '!A"%&$C #EA(D!DF%(%!#AGC'FCD(AGC'('#%"AD!NAD""$C%"ADAIC'DNA$!N%C"#D!N !FA'BA"%&$C #EAD!NA"%&$C #EA(D!DF%(%!#MA%"#DIL "J%"AG'L & %"AD!NAGC'&%HN$C%"A#JD#AJ FJL FJ#A#J%A'CFD! PD# '!Q"AV%EA"%&$C #EAC "V"AD!NA#J%A"#%G"AI% !FA#DV%!A#'ADNNC%""AD!NA( # FD#%A#J%(MAD!NA N%!# OA%"A%(%CF !FA"%&$C #EA#JC%D#"A%DCLE�A�J%A !B'CH(D# '!A"%&$C #EAGC'FCD(A($"#AC%wA%&#A#J%A'CFD! PD# '!Q"A!%%N"AD!NAC "VA#'L%CD!&%xA#JD#A "MAJ'�A($&JAC "VA #A "A� LL !FAD!NADIL%A#'AD&&%G#MAF K%!A#J%A&'"#A'BA( # FD# '!�

Page 6: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123456-7,468,921:,-3;-<;=34>?213;-@,9/412ABCDEFGHIJKL$M #"NOP%N'QQ'P#$! # %"NR'PN&'(QO! %"N#'N (QP'S%TNUO"%MN'!NO$M #'PNO!OVW" "NO!MNOMS &%�N�'NQP%"%PS%N#X%N !#%YP #WNO!MNO$#X'P #WN'RNO$M #"TNO$M #'P"N(O !#O !NONM%V &O#%NUOVO!&%NU%#�%%!N'RR%P !YNOMS &%NO!MN(OZ !YNM%& " '!"�['PN%O&XN'PYO! \O# '!TN#X%N"&'Q%N'RNO$M #'PNP%"Q'!" U V #WN"X'$VMNU%NM'&$(%!#%MN !N#X%N&'(QO!W]"N !#%P!OVNO$M #N&XOP#%PNO!MNU%NOQQP'S%MNUWN#X%NO$M #N&'(( ##%%�N%&O$"%N%S%PWN'PYO_! \O# '!NXO"NM RR%P%!#NY'OV"NO!MN'U%&# S%"aO!MN&%P#O !VWNM RR%P_%!#N ""$%"NO!MN&XOVV%!Y%"a#X%P%N "N!'N'!%_" \%_bN#"_OVVNO$M #NQP'&%""TN!'PN'!%NO$M #NOQQP'O&XN#XO#NbN#"NOVVN" #$O# '!"�Nc "#'P &OVVWTN !R'P(O# '!N"%&$P #WNO$M #"NXOS%NR'&$"%MNQP (OP VWN'!N#X%N%!#%PQP "%N !RPO"#P$&#$P%NdP'$#%PNV'&O# '!"TN�XO#NZ !M"N'RN"%PS%P"NOP%N !S'VS%MTNX'�N"%PS%P"NOP%NQP'#%&#%MTNX'�N(O!OY%(%!#NO"" Y!"NO!MN%!R'P&%"N"W"#%(NO&&%""NQ%P( "" '!"TNX'�N(O!OY%P"NO""%""N"#ORRN&'(Q%#%!&%NO!MN#P$"#�'P#X !%""TN%#&�e�N�!&P%O" !YVWTNX'�%S%PTN !R'P(O# '!N"%&$P #WNO$M #"NOV"'NXOS%NON" Y! bN&O!#N%f#%P!OVN&'(Q'!%!#�N['PN%fO(QV%ghNc'�NOP%NUO&Z$QN#OQ%"N#PO!"R%PP%MTNO!MN�X%P%NOP%N#X%WN"#'P%MihNj'%"N#X%N&'(QO!WNXOS%N&'!bNM%!&%N#XO#N"#'POY%NS%!M'P"NOP%N&'(Q%#%!#NO!MN(O !#O !N !R'P(O# '!N"%&$P%VWihNc'�N($&XN"X'$VMN#X%N&'(QO!WN#P$"#N&$"#'(%P"TN"$QQV %P"TNO!MNQOP#!%P"N#XO#NXOS%NO&&%""N#'N"%!" # S%N !#%P!OVNMO#Oi hNkXO#N "N#X%N&'(QO!W]"N%fQ'"$P%N#'NV'&OVTN"#O#%TNR%M%POVTNO!MN !#%P!O# '!OVNP%Y$VO#'PWN'PNVO�N%!R'P&%_(%!#N ""$%"iNj'NVO�"NM%(O!MNQ'V & %"N'PNQP'&%""%"N#X%N&'(QO!WN�'$VMNPO#X%PN!'#NQP'S M%lN RN"'TN&O!N#X%N&'(QO!WNM%R%!MN #"NQ'" # '!i�X%N" \%NO!MN&'(QV%f #WN'RNSOP '$"N'PYO! \O# '!"]NO$M #N%RR'P#"NM RR%PNM$%N#'NSOP O# '!"N !N'Q%PO# !YN%!S P'!(%!#"TNP "ZNQP 'P # %"NO!MN#XP%"X'VM"TNO!MNU$" !%""NO!MNO$M #N'U%&# S%"�N�!NOMM # '!TN#X%N"&'Q%N'RNO$M #"N&O!NSOPWNRP'(NQP'%&#N#'NQP'%&#TNM%Q%!M !YN'!NO$M #'P]"NR'&$"NdR'PN%fO(QV%TN'!NSOP '$"NU$" !%""NQP'&%""%"TN(O!OY%(%!#N&'!#P'V"TNO!MN#%&X! &OVN&'!#P'V"e�Nm!"$P !YNOQQP'QP O#%NO$M #NR'&$"N "NO!'#X%PNP%O"'!N(O!OY%(%!#N"X'$VMN&'(($! &O#%N� #XNO$M _#'P"TNO!MNS &%NS%P"OTN%OPVWNO!MN'R#%!NR'PN%S%PWNO$M #NQP'%&#��!#%P!OVNO$M #'P"N"X'$VMNQ%PR'P(N'PYO! \O# '!OVNP "ZNO""%""(%!#"NO!MN%SOV$O#%N#X%NO$M #N$! S%P"%NO!MN"$QQ'P#_ !YNO$M #NQVO!"NO#NV%O"#NO!!$OVVWTNO!MN"'(%# (%"N('P%NRP%n$%!#VW�oNL#N#X%N( &P'NV%S%VTNO!NO$M #NP "ZNO""%""(%!#N'RN#X%NSOP '$"N%!# # %"NU% !YNO$M #%MN "N&'(QV%#%MN#'N"$QQ'P#N#X%NO$M #NQP'%&#Nd"'(%# (%"NOV"'NP%R%PP%MN#'NO"N#X%NO$M #Np#%P("N'RNP%R%P%!&%qe�NrVO!! !YNR'PN%O&XNO$M #NP%n$ P%"N"%P '$"N&'!" M%PO# '!N'RN#X%N'PYO! \O# '!"]"N(O!WNP "Z"NO!MN'QQ'P#$! # %"�N[ !OVVWTN !N(O!WN&'(QO! %"TN&'!_# !$'$"NO$M # !YNd'!Y' !YNO$M #N%SOV$O# '!"eN "NU% !YN (QV%(%!#%MNR'PNZ%WN"W"#%("NO!Ms'PNZ%WN#PO!"O&# '!"�otuvwtxvwytz{|vwx}~zv{�twy|ywt~vt��}{�v{�t�}{�t����t~�yt���z~vw�t���z{y��t�z��t���t���z~t�z����t��t�vx��z}{�yt�{�~z~�~y�t�}�t��t�����t�~~��������z~�z{�~z~�~y��vx��z���}��}����z���� ¡�¢£¤¥¦§£©ªª«¬­£®¦§°©¥£¦®­¤±²§£¥«­©²³£¥¤­©µ±­¦²¤±³­¦®­¥±­±®¥±§¶§£¤±­£®§©¤¥§²¥²§±···­®§±©¤£®¹ª«¬­¦º±µ±§¬­©²³£¥¤­©ª¤¦­©µ±­©­¤£¹®£»­©®¥­±¼¥±§®©ª­¦°¶¦®±®¥·

Page 7: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./-01/2,3/4561-7,8-.37,89:;4,3-<1=>84;?@�A%BC'DEFB'GBF E%&#'E"HB(D!DI%(%!#BJ'GB��HB !G'E(D# '!B"%&$E #KHB"#DGGHBD!FBC$" !%""BL !%"MHBD!FB !#%E!DLBD$F #'E"BDLLBADN%B" I! OB&D!#BE'L%"B !B !G'E(D# '!B"%&$E #KBD""$EPD!&%BD!FB#A%BD$F # !IB'GB !G'E(D# '!B"%&$E #KB%GG'E#"�B�A%BC IBQ$%"# '!BG'EB(D!KB&'(RD! %"B "BA'�B#A%"%B"#DS%PA'LF%E"B"A'$LFB�'ESB#'I%#A%EB#'B%!"$E%B#AD#B%N%EK#A !IB#AD#B"A'$LFBC%BF'!%B#'BRE'#%&#B"%!" # N%B !G'E(D# '!B "BC% !IBF'!%TD!FB#AD#B#A%B&'(RD!KU"B !G'E(D# '!BD""%#"BDE%BRE'#%&#%FBDRRE'RE D#%LK�BV�B�A%B5,:8W-,7-W481=;,8/B($"#BRE'N F%B'N%E" IA#BD#BDBL%N%LBDC'N%B'#A%EBC$" !%""B(D!DIP%E"�B�A%BF E%&#'EU"BE'L%B !B !G'E(D# '!B"%&$E #KB "B#'BD"SB(D!DI%E"B#A%BE IA#BQ$%"# '!"BD!FB%!&'$EDI%B#A%BE IA#BE%"$L#"�BX E%&#'E"B($"#B"%#BDRRE'RE D#%B#'!%BD#B#A%B#'RHB&'(($! &D# !IB#'B%Y%&$# N%B(D!DI%(%!#B#A%BC$" !%""B (R%ED# N%B'GB%GG%&# N%B !G'EP(D# '!B"%&$E #KB(D!DI%(%!#�B�A%BC'DEFBDL"'BAD"BDBE'L%B !B%"#DCL "A !IBD!FB'N%E"%% !IB"%&$E #KBR'L &KBD!FBF%OB! !IB#A%B&'ER'ED#%B"%&$E #KB&$L#$E%T�A &AB !&L$F%"B"%&$E #KBD""$ED!&%BD!FB%#A &"BD## #$F%"�Z�B[\1=>;4]1-9:3:1913;B($"#BRE'N F%BL%DF%E"A RB#'B%!"$E%B#AD#B !G'E(D# '!B"%&$E #KB%GG'E#"BDE%B"$RR'E#%FBD!FB$!F%E"#''FBD&E'""B#A%B'EID! _D# '!HBF%('!"#ED# !IBCKB%YD(RL%B#A%B(D!FD#%B'GB"%&$E #KBR'L & %"�BY%&$# N%B(D!DI%(%!#B($"#BDL"'BF%F &D#%B"$GOB& %!#BE%"'$E&%"B#'BDLL'�B&'!#E'L"B#'BC%B%GG%&# N%�B a !DLLKHBCKB%!"$E !IB#AD#B#A%B !G'E(D# '!B"%&$E #KBRE'IED(BD!FB #"B(D!DI%(%!#BDE%B"$Cb%&#B#'BD$F #BD!FBE%N %�%FBCKBQ$DL OB%FBRE'G%"" '!DL"HB&'ER'ED#%BL%DF%E"BDFND!&%B#A%BI'DLB'GB"%&$E #KB'N%E" IA#BD!FBRE'('#%BB&'!# !$'$"B (RE'N%(%!#BD!FB"$&&%""�B c�B<;:77-:3W-6431d,7d5>/431//-9:3:18/B($"#BADN%BDBN' &%B !B#A%BF%" I!BD!FB (RL%(%!#D# '!B'GB !G'E(DP# '!B"%&$E #KBRE'IED("HB" !&%B#A%B(D!DI%E"BDE%BA%LFBD&&'$!#DCL%BG'EBRE'#%&# !IBD!FB%!AD!& !IB#A%BNDL$%B'GB#A%B'EID! _D# '!U"BD""%#"HB !&L$F !IB !G'E(D# '!BD""%#"�BeD!DI%E"B($"#BDL"'BE%N %�BD!FB('! #'EB"%&$PE #KB&'!#E'L"B#'B%!"$E%B#A%KBDE%BDRRE'RE D#%HBF%"R #%B%N%EP&AD!I !IBE "S"BD!FBC$" !%""BE%Q$ E%(%!#"�B�A "B "HB !BGD&#HBDBG'E(B'GBD$F # !IB !G'E(D# '!B"%&$E #K�Bf!FHBOB!DLLKHB(D!DI%E"B�A'B'�!BC$" !%""P$! #B !G'E(D# '!B"A'$LFBDL"'BA%LRBF%OB!%B#A% EB"%&$E #KBE%Q$ E%(%!#"HBCD"%FB'!BC$" !%""B'Cb%&# N%"HB#A%B" I! OB&D!&%B'GB#A%B !G'E(D# '!B !N'LN%FHBL%IDLBE%Q$ E%(%!#"HBD!FB#A%B"%E '$"!%""B'GB#AE%D#"B#'BFD#DB !#%IE #KBD!FBF "&L'"$E%BJRE ND&KM�BeD!KB&'(RD! %"BADN%BDB"%RDED#%B(D!DI%E DLB"#E$&#$E%B� #AB�A'LLKBF%F &D#%FB !G'E(D# '!B"%&$E #KB%Y%&$# N%"HB(D!DI%E"HBD!FB#%&A! P&DLB"#DGG�B�'LL%&# N%LKHB#A "B !G'EP(D# '!B"%&$E #KBG$!&# '!B($"#B'EID! _%HB'N%E"%%HB (RL%(%!#HB#%"#HBD!FB('! #'EB#A%B'EID! _D# '!U"B#%&A! &DLB !G'E(D# '!B"%&$E #KBRE'IED(�BBB fL#A'$IABC$" !%""B(D!DI%E"B'G#%!B#EKB#'BE%L%ID#%B !G'E(D# '!B"%&$E #KBE%"R'!" C L # %"B#'BD!B !G'E(DP# '!B"%&$E #KB(D!DI%(%!#BG$!&# '!HBDLLBRDE#"B'GB#A%B'EID! _D# '!BADN%B !G'E(D# '!B"%&$E #KBE%"R'!" C L P# %"�Bg%&$E #KBI'DL"B !&L$F%BDB( Y#$E%B'GB#%&A! &DLHBRE'&%F$EDLHBD!FB'N%E" IA#B&'!#E'L"HBDLLB'GB�A &AB"A'$LFBC%BE%N %�%FB'EB#%"#%FBCKBDLLBDRRE'RE D#%B"#DGGBD!FB(D!DI%(%!#B#'B%!"$E%B#A%KBDE%BJDMBDF%Q$D#%HBD"BF%OB!%FB#'B( # ID#%B !G'E(D# '!B"%&$E #KBE "S"HBD!FBJCMBE%D"'!DCLKB%GOB& %!#BD!FB%GG%&# N%B !BRED&# &%�Bhijklmnkopmqrstqqouvsvntwqolxjtsojwyojlowtitnvjtoqtzmwrjyowtq{lsqrprirjrtqojlovsorsxlwuvjrlsoqtzmwrjyouvsvntutsjoxmszjrls|oviio{vwjqolxojktolwnvsr}vjrlsokv~toqtzmwrjyowtq{lsqrprirjrtq�

Page 8: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*�+�,%+-./01.234256-/475.8/-9.+:;'< =%"+"#;>#%? &@+':%;># '!>A@+>!=+#>&# &>A+<>A$%+#'+>!+';?>! B># '!�+C';+%D>(:A%@+ !#%;!>A+>$= # !?E+F+�!G';("+#,%+H'>;=+>!=+(>!>?%(%!#+>"+#'+�,%#,%;+H$" !%""+$! #"+$!=%;"#>!=+#,%+ (:';#>!&%+'G+"%&$; #I+>!=+>;%+>=,%; !?+#'+:'A & %"@+�,%#,%;+J%I+ !G';(># '!+>""%#"+>!=+"I"#%("+>;%+"$GK+& %!#AI+"%&$;%@+�,%#,%;+:;'?;>("+>;%+ !+:A>&%+G';+&'!# !$L>AAI+$:=># !?+>!=+"#;%!?#,%! !?+">G%?$>;="+>?> !"#+ !#%;!>A+>!=+%D#%;!>A+"%&$; #I+#,;%>#"@+>!=+�,%#,%;+#,%+:'A & %"+>;%+;%>"'!>HA%�+�!+H; %G@+ !#%;!>A+>$= #"+>""%""+#,%+"#>#%+'G+#,%+ !G';(># '!+&'!#;'A+%!< ;'!(%!#+>!=+;%&'((%!=+ (:;'<%(%!#"�F+�!=%:%!=%!#AI+<>A =>#%"+#,>#+#,%+';?>! B># '!M"+ !G';(># '!+"%&$; #I+%GG';#"+>;%+:;'>&# <%+>!=+%GG%&# <%+>?> !"#+&$;;%!#+>!=+%(%;? !?+#,;%>#"�+�'+:;'< =%+#, "+A%<%A+'G+>""$;>!&%@+ !#%;!>A+>$= #';"+(>I+&'(:>;%+&$;;%!#+';?>! B># '!>A+:;>&# &%"+� #,+ !=$"#;I+:;>&# &%"+>!=+;%?$A>#';I+?$ =%A !%"�+N'#>HAI@+>$= # !?+:;'< =%"+'!AI+>+;%>"'!>HA%+A%<%A+'G+>""$;>!&%�+O$= #';"+&>!!'#+:;'< =%+>!+ !"$;>!&%+:'A &I+>?> !"#+>!I+G>$A#+';+=%K+& %!&I@+:>;# &$A>;AI+ !+;%?>;=+#'+>&# < # %"+#,>#+&>!!'#+H%+#'#>AAI+&'!#;'AA%=@+"$&,+>"+&'AA$L" '!+>!=+(>!>?%(%!#+'<%;; =%�+�'+G$AK+AA+>!+>$= #M"+:'#%!# >A@+,'�%<%;@+#,%+ !#%;!>A+>$= L#';"+!%%=+#'E+PQ+J!'�+�,>#+#,%I+>;%+=' !?+R �%�@+,><%+#,%+"J AA"+#'+:%;G';(+>::;':; >#%+"%&$; #I+>$= #"Q@+SQ+,><%+>+"#;'!?+$!=%;"#>!= !?+'G+H'#,+#,%+#%&,! &>A+>!=+#,%+H$" !%""+%!< ;'!(%!#@+TQ+J!'�+�,>#+#'+>"J+G';@+>!=+*Q+&'(:A%#%+;%?$A>;+>!=+'!?' !?+#;> ! !?+#'+J%%:+'!+#':+'G+!%�+?$ =>!&%+>!=+"#>!=>;="+'G+:;>&# &%�+�!+>== # '!@+#,%+>$= # !?+G$!&# '!+",'$A=+U&'(:A%(%!#@V+H$#+!%<%;+;%:A>&%@+(>!>?%(%!#M"+;%":'!" H A #I+#'+%!"$;%+#,% ;+��+"%&$; #I+&'!#;'A"+>;%+':%;># !?+:;':%;AI�+

Page 9: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,+-./.,0123456.37,308.39:;703<=5>.22?!@ !#%A!BC@B$D #@%!EBE%(%!#@#FG &BCCF@HB"@#HA%%@GHB"%"I@GCB!! !EJ@#%"# !EJ@B!D@A%G'A# !E�@KB!BE%(%!#@HB"@B!@ (G'A#B!#@A'C%@ !@%B&H@GHB"%ILMNMOPQRSMNTSMUTVWXQRSRYXUZTS[XQ\SWXOPWYPQSWYQXUOYXUWSWYPSMUTVWS]QXPRRSWXSPNRUQPSWYMWSMUTVWXQRS]UQRUPSM]]QX]QVMWPSOXMZRSMNTSYM_PS]QX]PQSVNRVOYWSVNWXSaSMNTSbURVNPRRS]QXPRRPRcSdXXTSXeeUNVMWVXNSWYQXUOYXUWSWYPSMUTVWS]QXPRRSYPZ]RSPNRUQPSWYMWSMUTVWSfSNTVNORSMQPSQPZP_MNWSMNTSMNSbPSURPTSWXSbPNPfSWSWYPSXe]MNgc*9 9 *99:;7030.+/3;.h.65i23+:;703i6+,+,;3>5//:,7>+0.23053/+,+-./.,0*+,+-./.,03+,;3+:;7030.+/23;72>:223+:;703-5+62j32>5i.j3i:=i52.j3+,;3>=70.=7+**99 9:;7030.+/3722:.23;=+k03=.i5=09 *+,+-./.,03+,;3+:;7030.+/23/..03=.-:6+=6l3053;72>:223+:;703i=5-=.2233+,;3722:.29:;705=23i.=k5=/30.207,-*+,+-.=23h+67;+0.30.207,-3i=5>.22.2*9:;7030.+/3722:.23k7,+63=.i5=0*+,+-./.,03=.h7.m23k7,;7,-23+,;33n.-7,23i6+,,7,-3>5==.>07h.3+>075,2*+,+-./.,03=./7023>5//.,02*9 <o9ppqpr<s9tu vutvqpr<s9tu4u<w4vqpr<s9tuxyz{|}~���y�{~x|{���}����} ������������������������������������������� �¡�������������¢��£����¤�������¢���¥��¦�������£§���������������������������������������������¢��������������������©¢����������¢��£��£����� �¡���������££���¡�ª�«���£����£��¢�¢¬���¢�¡���¢���©¢����������¢�������������¢��������������¢��� �¡��������£������������������������¢�������¡�����¢¡�������¢���­£�¡���¢�����£� ����ª�«��¢��£����¢���������� �¡������¡�¢�¢¡����������¢�¢¬���¢�®�����������¢�®�����������¡���¢�����ª�°����¢��������¡�¢¬��¢�¬��¬������±������������¢�����¢��£����¢���¢��¬¢������������¬��������¡¡����� ����¢�����������¢�ª� ²�����������������������¢�¡���������¬�����¢���¡�¢���¢�����¢�����©¢�������¢��������¢��������¢�®������������£������ª�³¢����±������������������¢�����������������±��¢�¡����£����������¢������¢����������������¢������������¬������������¢�±������¢�¡���¢����������¡�����������±�������££��£�¢���ª���������µ¶���������������� �¡¢�¢�������������¢����¥��¡¡��������££��£�¢����£��£��������±�����ª�²����������¡���������������¢�����������������·£�� ���¢��������¡���������������¬��¢ ±¢���£��¡���������������¢�������������¢��¡�������¡��¢���������¢������¢���ª�°������¢���������������������¢����­�¡��¢¬���� ������������¢������¢������������������������±�������������������¢��£��¡��� ������±�©��®�±����������������¡��������� ����¢�¡�������¢��£���������¢����¢�����¢�����������£�����¢����¡�¢���ª�� «���£���������£�������¢���������©�������¢������ ����� ���������������������������¢��������������¡������¬�����¢�����������¢������������¬���¢�£���������¢����� �����������¢�������¢������¢������ ����£���ª�°������¢��������������¡�����¢¡����¡�¢�¢¡�������¢�������������������������±����£���¢�����¬�������¢���� ����������¢���������¢����¡������ª�°���������¢������±����������¬¢�©������¢���������������¢��������£���£�����¢¡��¢����¡�����±�����������±��££��¡¢����ª¹��������µ�º�������������������¡�¢¬���������¬¢�©����������¢����� ����¢������£�����������¬���£��¡����¡�¢¬���¡�¢���������¢�£��������¡�����ª

Page 10: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./012-345.*,6-.-3.7889$: #";%< "#;#';=""%"";>'�;�%??;=;@$" !%"";$! #;'A;BA'CA=(;(%%#";#>%;B%AD'A(=!&%;C'=?";'D;#>%;'AC=! E=# '!F;=";: &G#=#%:;@H;#>%;�IJF;�KJF;@'=A:F;=!:; !L%"#'A"�;9&&'A: !C?HF;#>%;(=!=C%A =?;C'=?; !;=$: # !C; ";!'#;" (B?H;#';(=M%;=$: #'A";>=BBHF;@$#;#';:%('!"#A=#%;>'�;�%??;'B%A=# '!"F;&'!#A'?"F;=!:;A%"$?#";(%%#;#>%;!%%:";'D;#>%;@$" !%""�;N$A !C;=$: #;B?=!! !CF;(=!=C%A";>%?B;=$: #'A";#';:%" C!;=!;=$: #;BA'&%"";#>=#;#A$?H;A%O;%&#";@$" !%"";"#A=#%C %";=!:;C'=?"�;�>$"F;#>%;(=!=C%A =?;A%"B'!"%;#';=$: #'A";#>A'$C>G'$#;#>%;=$: #;BA'&%""PB?=!! !CF;#%"# !CF;=!:;A%B'A# !CP ";D'A;#>%;@%!%Q;#;'D;#>%;@$" !%""F;!'#; #";=$: #'A"�9$: #'A";%< "#;#';BA'L :%;#>%;@'=A:;=!:;"%! 'A;(=!=C%G(%!#;� #>;=!;'@R%&# L%F; !:%B%!:%!#;=""%""(%!#;'D;=;@$" !%"";$! #;'A;BA'CA=(;S"$&>;="; !D'A(=# '!;"%&$A #HTF; !&?$: !C;�>=#;#>%H;"%%;=";M%H;'BB'A#$! # %";D'A; (BA'L%G(%!#�;�';BA%B=A%;#>% A;'B ! '!";=!:;&'!&?$" '!"F;=$: #'A";!%%:;#';A%L %�;=!:;=""%"";%L :%!&%;'D;#>%;A "M;(=!=C%(%!#;BA'CA=(;=!:; #";B%AD'A(=!&%�;�D;=$: #'A";=A%;=@?%;#';:%('!"#A=#%;B%AD'A(=!&%;=!:;">'�;#>=#;=&&'$!#=@ ? #H;>=";@%%!;%"#=@? ">%:;=!:; ";�'AM !CF;#>%H;">'$?:;BA':$&%;=;B'" # L%;=$: #;A%B'A#P #U";#>=#;" (B?%�9&&'A: !C?HF;=$: #'A";=!:;(=!=C%A";">'$?:;�'AM;#';>%?B;%=&>;'#>%A;A%=&>;&'(('!;C'=?"P=$: #'A";"#A L !C;#';%=A!%"#?HF;>'!%"#?HF;=!:;&'(B?%#%?H;=""%"";BA'CA=(;%DD%&# L%!%""F;=!:;(=!=C%(%!#;�'AM !C;#';>%?B;=$: #'A";(=M%;L=? :;=""%""(%!#"�;�!;#>=#;L% !F;#>%A%;=A%;"'(%;#HB &=?;BA'CA=(;&>=A=&#%A "# &";=!:;(=!=C%A =?;BA'&%""%";#>=#;=$: #'A";:';=!:;:'!U#;? M%;#';"%%�;9"; !;=??;="B%&#";'D;=$: #;=!:;A "M;(=!=C%(%!#;BA'CA=("F;=$: #'A;? M%";=!:;: "? M%";L=AH;@H;&'(B=!HV;>'�%L%AF;#>%;D'??'� !C;? "#; #%(G E%";#HB &=?; !: &=#'A";'D;C'':;=!:;@=:;=$: #"� WXYZ[\]_Zabccc_deffgdhijiklhljmdnoipmqplrsdntijjqjkudgqolpmqfjudhfjqmfoqjkudolnfomqjkudlmpvdwofipmqxldhijiklhljmudqjptygqjkdzol{yljmdfnloimqfjitdhfjqmfoqjkd|ynloxqrfo}dolxql~dfzd�l}dnlozfohijpldolnfomrd|ynloxqrfo}dolxql~dfzdfnloimqjkdolrytmrd�lrnlpqitt}dl�plnmqfjdolnfomrdijgdijit}rlr�d�okijq�lgudptlioudijgdyn�mf�gimldgfpyhljmimqfjd�ltt�gfpyhljmlgdnftqpqlrdijgdnofplgyolrd�ijikloqitdipmqfjrd�irlgdfjdzipmrudjfmd�i�qmrd�dgfpyhljmlgdp�iqjdfzdpfhhijgudoftlrudippfyjmi�qtqm}udijgdolrnfjrq�qtqmqlrd�lvkvudfokijq�imqfjdp�iomrud�f�dglrpoqnmqfjrudrlnioimqfjdfzdgymqlr�d�fjrqrmljmdig�loljpldmfdnftqp}dijgdnofplgyolrudzofhdrljqfodhijiklhljmdm�ofyk�dzofjmtqjldrmizzdeffgdrmizzdhijiklhljmudqjptygqjkd~fo�zfopldglxltfnhljmd��ljp�drmoljkm�dijgdpofrrdmoiqjqjk�udirryoijpldm�imdi�rljplrdgfdjfmdpfhnofhqrldpfjmoftrudijgdnftqpqlrdzfodrlpyoldrmizzdmyojfxlod�d�itijpld�lm~lljdr�fom�dijgdtfjk�mlohdzfpyrudzfod�fm�df��lpmqxlrdijgdolrytmrd�ijikloqitd~qttqjkjlrrdmfdlh�oipldjl~dqglirdWXYZ[\]_�\��[_Zabccc_d�jmloxql~qjkdglzljrqxldfodyjqjzfohlgdhijiklordijgdl�lpymqxlrdd�igqjkdm�ofyk�dnqtlrdfzdgqrfokijq�lgdijit}rlrdd�ijiklord~�fdpij�mdfod~fj�mdpfhnol�ljgdm�ldtlxltdfzdoqr�dm�l}dioldqjpyooqjkd��ldfnnfrqmldfzdm�ld�tq�l�dqmlhrdtqrmlgdi�fxld

Page 11: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-.+/012345-6721894:;42;<=-+:-72;42;3+21<<=>-*4<0-+:-*3284:-?@83;+:5-A'#BC#B%CD$E #C#%D(CD!EC(D!DF%G"C"B'$HECDIIG'D&BC%J%GKCD$E #CIG'&%""C !CDCI'" # J%CD!EC'I%!C(D!!%G�C�LC(D!DF%(%!#CD!EC"#DLLCDG%CE%L%!" J%MC!%FD# J%MC'GC%J%!CB'"# H%MCD!CD$E #CIG'N%&#C&D!CO$ &PHKC%J'HJ%C !#'CDC!'Q� !MCF J%Q!'QO$DG#%GC#KI%C'LC%JDH$D# '!C#BD#C$H# (D#%HKCED(DF%"C%J%GKCIDG#KC !J'HJ%E�CRJ%!C�%HHC !#%!# '!%EC(D!DF%(%!#C&D!C !DEJ%G#%!#HKCB !E%GC#B%CD$E #CIG'&%""MCB'�%J%G�CSD!DF%(%!#C&D!C% #B%GCB%HIC'GCB !E%GC#B%CD$E #CIG'&%""CTKUCVWXYZ[V\]_aVbcdecfZcgVgYheicZ]Z_YV]]_j]kjcV]ZVZ\cVlbc]bb]acgVZ_icVVWXYZ[ViccZ_aVgc]gj_cfV]gVWYZ[VfZYcm]jj_aVVWXYZ[VhYiie_h]Z_aV]ZV]V]llbYlb_]ZcVi]]acb_]jVjccjVVWXYZ[Vcfeb_aVncoVfZ]ppV]bcV]]_j]kjcVZYV]eg_ZYbfqVcflch_]jjoV]ZVhb_Z_h]jVi_jcfZYcfVVWXYZ[V_pYbi_aVbcjc]ZVfZ]ppV]kYeZVZ\cV]eg_ZV]gV_ZfVaY]jfqV_il]hZ_aVZ\cVZ_icV]gVcppYbZV]eg_ZYbfViefZVflcgVZYVcrlj]_VZ\cV]eg_ZVZYV]ppchZcgVlcbfY cjVVWXYZ[V\]_aV]gi__fZb]Z_cVfellYbZVm\cbcVccgcgVVWXYZ[VlbY_g_aV]hheb]ZcVgYheicZ]Z_YVWXYZ[V\]_aV]V]eg_ZVh\]bZcbVpYbVZ\cV_Zcb]jV]eg_ZVpehZ_YVV st+-ut+@<8-v1<w-;+-;t4-?@83;+:5x-y!C%LzC& %!#CD$E #CIG'&%""CE%I%!E"C'!C%LL%&# J%C&'(Q($! &D# '!CT%#�%%!CD$E #'G"MC(D!DF%G"MCD!EC�'GP%G"�CSD!DF%(%!#CD!ECD$E #'G"C"B'$HEC"#G J%C#'CTDHD!&%C%LzC& %!&KC{BDJ !FCDC( ! (DHC!$(T%GC'LC"#DLLCE%DH !FCE G%&#HKC� #BC#B%CD$E #'G"|C� #BC#B%C!%%ECL'GC}'I%!CD&&%""~C#'C(D!DF%(%!#CD!EC"#DLLCTKC#B%CD$E #C#%D(C{�B%!C!%%E%E|��C�TJ '$"HKMC #C "C (IGD&# &DHCD!EC$!IG'E$&# J%CL'GCT'#BC#%D("C#'CI$#C#''C(D!KC"#DLLC !CLG'!#C'LCD$E #'G"�C�!"#%DEMC(D!DF%(%!#C"B'$HEUV�bY_gcVnYmjcgacVYpVYlcb]Z_YfVZ\bYea\Vfccb]jV_pYbicgVlY_ZVlcYljcVZYV_Zcb]hZVm_Z\V]eg_ZYbf�V�V�f\YbZVj_fZ�VYpV_Zcb_cmccfVm_Z\_VZ\cVlbYab]iV]bc]Vkc_aV]eg_ZcgVh]ViYbcVde_hnjoV]fmcbV]eg_ZYbVdecb_cfV]gVlbY_gcVkcZZcbVhYZ_e_ZoVYpV]eg_ZVfellYbZ�VV�jjYmVbc]goV]hhcffVZYV]jjVi]]acicZV]gVfZ]ppqV_pVbcde_bcgVkoVZ\cV]eg_ZVZc]iVZYVa]_V]Vhjc]bcbVl_hZebcVYpVYcb]jjVYlcb]Z_YfVV�YbnVm_Z\VZ\cV]eg_ZVZc]iVZYVgb]mVelV]VfZ]ppV_Zcb_cmVfh\cgejcV]fVl]bZVYpVZ\cVlj] _aVcppYbZ�V�lg]ZcVZ\cVfh\cgejcV]fVchcff]boVgeb_aVZ\cV]eg_ZV�VcjgmYbnVl\]fcqV_pVh_bheifZ]hcfVh\]ac�V�!C(D!KC" #$D# '!"MCDC" !FH%CI' !#C'LC&'!#D&#CL'GC%D&BCD$E #%ECIG'FGD(C� HHCIG'J E%C#B%CJD"#C(DN'G #KC'LCE'&$(%!#D# '!C#'C#B%CD$E #C#%D(�C�B%CG'H%C'LC#BD#C !E J E$DH�D!EMC !E%%EMCL'GCDHHCD$E #'GC&'!#D&#"� "C#'C%!"$G%C#BD#C#B%CD$E #C#%D(CG%&% J%"CD&&$GD#%CD!ECDE%O$D#%C !L'G(D# '!CL'GC#B%C#D"P�Cy$E #'G"C� HHC"# HHC$"%C#B% GCIG'L%"" '!DHCN$EF(%!#C#'CE%#%G( !%C LCD!EC�B%!CDEE # '!DHC"'$G&%"C'LC !L'G(D# '!C{'#B%GC"#DLLC !#%GJ %�"|CDG%CG%O$ G%E�C�B%CD$E #C#%D(C� HHCDH"'C&'!E$&#CDCJDG %#KC'LCD$E #C#%"#"MC LC!%&%""DGKMC#'C&'!zCG(C#B% GCD$E #CD!DHK" "�C�C���������������������������������������������������������������������������� ��������������������������������������������������¡

Page 12: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123.,45678/3294:8;324<=67>?3@24A'$BCD$E #F"CG'DH"IC"&'J%ICD!ECJ$BJ'"%CE%#%B( !%C#K%CDJJB'JB D#%CD$E #CJB'&%E$B%"CD!ECL$%"# '!"�CM!CD$E #C'NC !N'B(D# '!C"%&$B #OC"K'$HECE%#%B( !%C#KD#CP%OCB "P"C#'C#K%C'BGD! QD# '!CDB%CR% !GC&'!#B'HH%EIC#KD#CP%OC&'!#B'H"CDB%C'J%BD# !GC%NN%&# S%HOCD!EC&'!" "#%!#HOICD!EC#KD#C(D!DG%(%!#CD!EC"#DNNCKDS%C#K%CDR H #OC#'CB%&'G! Q%CD!ECB%"J'!EC#'C!%�C#KB%D#"CD!ECB "P"CD"C#K%OCDB "%��K%CN'HH'� !GC&K%&PH "#CG%!%BDHHOCE%"&B R%"C !N'B(D# '!C"%&$B #OCD$E #C"#%J"C#KD#C(D!DG%(%!#C( GK#CN'HH'�C !CJB%JDBD# '!CN'BCD!ECE$B !GCD!CD$E #�C�K%CH "#CE'%"C!'#CD##%(J#C#'C #%( Q%C%S%BOCJ'"" RH%C !N'B(D# '!C"%&$B #OC'RT%&# S%ICR$#CBD#K%BC#'CJB'S E%CG%!%BDHCG$ ED!&%C'!CE%N%!" RH%C&'!#B'H"CD!ECDCH'G &DHC&'!#B'HCK %BDB&KO�UVWXYZ[\] X_`abcdefghhcdifcjcklmndogoghgdkfpdqhlqhbcgohcpodkdefghmkdo`rdodscpnlqhbcgoqlpidhglonctepghumplspdidoflhbcpdmmplmpgdhccvctehgjcnicchwghbhbcdefghhcdihlpcjgcwdefghmplspdinhcmndoffcxocycumkducpndofoctcnndpupcnleptcn`rdodscicohtlkkcthnmplspdiflteicohdhglogompcmdpdhgloqlpdefgh`rdodscicohnemmlphndmpckgigodpunepjculqhbcgoqlpidhglonctepghumplspdiz{uhbcgohcpodkdefghhcdi|`abcdefghhcdifpdqhnhbcgohcpodkdefghmplspdimkdo`rdodscicohdof{ldpfici{cpnmpljgfcqccf{dtylohbcfpdqhmkdo UVWXYZ}~�YX_�D!DG%(%!#CKD"CDCB%"J'!" R H #OC#'C%!"$B%C#KD#CD$E #C#%"# !GC "CJB'E$&# S%�C�K%CD$E #C#%D(CJ%BN'B("C#%"#"C#'C !E%J%!E%!#HOCD""%""C#K%CJ%BN'B(D!&%C'NC#K%C !N'B(D# '!C"%&$B #OCJB'GBD(CD!EIC�K H%C#K%CD$E #C#%D(C$H# (D#%HOCE%#%B( !%"C#K%C!D#$B%C'NC#K%"%C#%"#"CD!EC#K%C%�#%!#C'NC#%"# !GC�%�G�C#K%C"D(JH%C" Q%"C#'C$"%�IC(D!DG%(%!#C"K'$HEC%!GDG%CD$E #'B"C !CE "&$"" '!"CDR'$#C#K% BC#%"# !GC(%#K'E"CD!ECG'DH"�C�!C#'!%IC(D!DG%(%!#C"K'$HEC#BOC#'C"#B P%CDCRDHD!&%IC!% #K%BC%!# B%HOCE%N%BB !GC#'C#K%CD$E #C#%D(C!'BC( &B'�(D!DG !GC#K%C !#%B!DHCD$E #C%NN'B#"�C�K%CP%OC "C#'CJB'S E%CJB'E$&# S%C !J$#C'!C#K%C%SDH$D# '!C(%#K'E'H'GOCR%N'B%CD$E #C(D!DG%(%!#C" G!"C'NNC'!C #�CM"C#K%C#%"# !GCJKD"%C� !E"C$JIC#K%CD$E #C#%D(C� HHCJB%JDB%C"$((DB %"C'NC #"CP%OC�C!E !G"�C�!N'B(D# '!C"%&$�B #OC(D!DG%B"C"K'$HECR%CJB%JDB%EC#'CJB'S E%CN%%ERD&PCD!EC&'((%!#"C'!CD$E #C"$((DB %"ICJB 'BC#'C#K%C('B%C�C!DHICN'B(DHCD$E #CB%J'B#��B'D&# S%C&'(($! &D# '!IC&D!E'BCNB'(CDHHCJDB# %"ICD!EC#K'B'$GKCE'&$(%!#D# '!C&D!CJB%S%!#C(D!OC"$BJB "%"CD!EC&'!�C &#"C#KD#C( GK#C'#K%B� "%CDB "%CE$B !GC#K%C#%"# !GCJKD"%�CK'�%S%BIC(D!DG%B"C( GK#C"# HHCE "DGB%%CNB'(C# (%C#'C# (%C� #KCD$E #CB%"$H#"�C�D!DG%(%!#C"K'$HEC"#B S%C#'CJB'S E%C"'H EC%S E%!&%�!'#CT$"#CDBG$(%!#�#KD#C"$JJ'B#"C #"C&'!#BD"# !GCJ'" # '!�C�D&#"CDB%C#K%C('"#C"$&&%""N$HC#''HCN'BC"�DO !GCD!CDES%B"%C'J ! '!CR%N'B%C#K%CD$E #CB%J'B#C "C�C!DH Q%E�� !&%C#K%CD$E #CB%J'B#C'N#%!CN'B("C#K%CRD" "C'NCN$#$B%C"%&$B #OCN'&$"CD!EC !S%"#(%!#IC(D!DG%(%!#C"K'$HEC%!"$B%C#KD#C%S%BOCD$E #CJ' !#CBD "%E�D!EC #"CB%HD#%ECB%&'((%!ED# '!� "CB%H%SD!#CD!ECSDH E�C� P%� "%IC%S%BOCD&# '!CJHD!CJB'J'"%ECROC(D!DG%B"C'BCD$E #'B"C"K'$HECR%CD&K %SDRH%ICDJJB'JB D#%IC&'"#C%NN%&# S%ICD!ECDRH%C#'CJB'E$&%CHD"# !GC%NN%&#�

Page 13: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( ))*+,-./*012/.34*5678122129:;<;=>?@9;<A9;BACDE?@9FEGHI>D>9;9JKCFKLEMMN9G>>DC<=9:;<;=>?@9@BHHE?D9;BACDE?@O9PC=PLI>Q>I9;@@>@@G><D9EM9DP>9C<ME?G;DCE<9@>FB?CDR9H?E=?;G9SCDP9C<D>?QC>S@9;<A9AEFBG><D;DCE<9EMTUU9VFEH>9;<A9@D?;D>=RW9C<FIBAC<=9PES9DPE?EB=PIR9DP>9H?E=?;G9;AA?>@@>@9HED><DC;I9?C@K@9;<A9FEGH;?>@9SCDP9C<AB@D?R9X>@D9H?;FDCF>@UU9VD?BFDB?>9;<A9?>@EB?F>@W9?>Y9>FDC<=9G;<;=>?C;I9FEGGCDG><D9DE9>MM>FDCQ>9C<ME?G;DCE<9@>FB?CDR9G;<;=>G><D9;<A9DP>9H?E=?;GO@9?EXB@D<>@@9?>I;DCQ>9DE9DP>9HED><DC;I9CGH;FD9EM9;AQ>?@>9>Q><D@UU9:;<;=>G><D9EM9HEICFC>@9;<A9?>I;D>A9H?EF>AB?;I9AEFBG><D;DCE<9UU9ZEGGB<CF;DCE<9EM9H?E=?;G9HEICFC>@9;<A9>[H>FD;DCE<@9DE9@D;K>PEIA>?@UU9\GH;FD9EM9H?E=?;G9>MME?D@9E<9E?=;<C];DCE<;I9FBIDB?>9UU9\<D>?<;I9><ME?F>G><D9H?EF>@@>@9;<A9FE<@C@D><FRUU9 <=EC<=9CGH?EQ>G><D9>MME?D@9:;<;=>?@9@BHHE?D9GE?>9A>D;CI>A9;BACD9;<;IR@C@9EM9DP>9C<ME?G;DCE<9@>FB?CDR9H?E=?;G9_BACDE?@9FEGHI>D>9DP>9>Q;IB;DCE<9EM9A>@C=<9;A>B;FR9_BACDE?@9FEGHI>D>9DP>9>Q;IB;DCE<9EM9FE<D?EI9>MM>FDCQ><>@@ +,-./*012/.34*a/1b2�c%de'ff'� !gdh&# i # %"d(hjdk%dl%m%h#%nd !d%h&cd'ed#c%dhe'l%(%!# '!%ndh$n #dml'&%""%"�9_BACDE?@9>Q;IB;D>9C<ME?G;DCE<9E<9C<ME?G;DCE<9@>FB?CDR9H?EF>@@>@9;<A9H?EF>AB?>@9:;<;=>?@9;@@C@D9;BACDE?@9SCDP9S;IKDP?EB=P@9EM9@>I>FD>A9H?EF>@@>@o9AEFBG><D;DCE<9EM9DP>9FE<D?EI@9_BACDE?@9>Q;IB;D>9DP>9B;ICDR9EM9C<ME?G;DCE<9=><>?;D>A9XR9DP>9C<ME?G;DCE<9@>FB?CDR9H?E=?;Go9DP>9>;@>W9?>IC;XCICDRW9;<A9DCG>IC<>@@9EM9;FF>@@9DE9@BFP9C<ME?G;DCE<9XR9K>R9A>FC@CE<9G;K>?@o9;<A9DP>9EH>?;DCE<;I9FE<@C@D><FR9SCDP9SPCFP9@BFP9C<ME?G;DCE<9C@9=><>?;D>A9_BACDE?@9;@@>@@9C<ME?G;DCE<9@>FB?CDR9H>?ME?G;<F>9G>D?CF@T9>[C@D><F>W9B@>MBI<>@@W9;HHICF;DCE<W9GE<CDE?C<=W9;<A9?>@HE<@>@9DE9A>QC;DCE<9_BACDE?@9>Q;IB;D>9SP>DP>?9?C@K9G;<;=>G><D9FE<D?EI@9;?>9@BMp9FC><DIR9H?>Q><DCQ>W9;@9S>II9;@9A>D>FDCQ>9_BACDE?@9A>p9<>9D>@D@9DE9FE<p9?G9DP>9EH>?;DCE<;I9>MM>FDCQ><>@@9EM9C<ME?G;DCE<9@>FB?CDR9;FDCQCDC>@q9r>@D@9GC=PD9C<FIBA>9G;<;=>G><D9;<A9@D;MM9C<D>?QC>S@W9AEFBG><D;DCE<9;<A9?>HE?D9?>QC>SW9A;D;9;<;IR@C@W9;<A9?>@BID9@;GHIC<=9ME?9?>F><D9C<CDC;DCQ>@9:;<;=>?@9H?EQCA>9?>B>@D>A9A;D;W9AEFBG><D;DCE<W9;<A9EX@>?Q;DCE<@9_BACDE?@9CA><DCMR9sE?9?>FEGG><At9EHHE?DB<CDC>@9ME?9CGH?EQ>G><D9EM9C<ME?G;DCE<9@>FB?CDR9;FDCQCDC>@9:;<;=>?@9;<A9;BACDE?@9FEGHI>D>9;<9>[CD9G>>DC<=9DE9AC@FB@@9;BACD9p9<AC<=@W9;BACDE?9?>FEGG><A;DCE<@W9;<A9G;<;=>?C;I9?>@HE<@>

Page 14: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./,0123,/24-3,/56.7,-289:;/7.<�!=>%!%?@AB=@$C #'?"=A''D=@#=#E?%%=#FG%"='H=&'!#?'A"I=(@!@>%(%!#B='G%?@# '!@AB=@!C=#%&E! &@A�=J #E !=#E%"%=&@#%>'? %"B=@$C #'?"=(@F=?%K %�=#E%=&'!#?'A"=A "#%C= !=#E "="%&# '!=L@!C=G'#%!# @AAF='#E%?"B=C%G%!C !>='!=#E%=@$C #M"=G$?G'"%=@!C=H'&$"N�=�E%=H'AA'� !>=A "#=?%G?%"%!#"=#E%=H$AA="G%&#?$(='H= !H'?(@# '!="%&$? #F=&'!#?'A"B=@"=C%O=!%C=PF=#E%=QR=>'K%?!(%!#M"=S@# '!@A=�!"# #$#%='H=R#@!C@?C"=@!C=�%&E!'A'>F=LS�R�NT=E'�%K%?B=@$C #'?"="E'$AC=!'#=�% >E#=@!C=?%K %�=@AA=&'!#?'A"=%U$@AAF�=V"="#@#%C=%@?A %?B=#E%=@&#$@A= !H'?(@# '!="%&$? #F=&'!#?'A"=#'=P%=@$C #%C=@?%=C%#%?( !%C=C$? !>=#E%=@$C #=GA@!! !>=GE@"%�=�'!#?'A"=@?%=@""%""%C=C$? !>=#E%=@$C #=#%"# !>=GE@"%�=W@!@>%(%!#="E'$AC=C%#%?( !%=�E &E= !H'?(@# '!="%&$? #F=&'!#?'A"=@?%=@GG?'G? @#%=H'?=%@&E='?>@! X@# '!@A=%!K ?'!(%!#B=P@"%C='!=#E%=&'?G'?@#%=? "D=G?'O=A%B=@!C=&'(G@?%=#E%=A "#=#'=#E%=&'!#?'A"= !=#E "="%&# '!B=�E &E=?%Y=%&#=@$C #=P%"#=G?@&# &%"=@!C=QR=H%C%?@A=>$ C@!&%='!= !H'?(@# '!="%&$? #F=(@!@>%(%!#�=V&&'?C !>=#'=#E%=QR=Z%C%?@A=�!H'?(@# '!=[?'&%"" !>=R#@!C@?C=LZ�[RN=\]]B=W ! ($(=R%&$? #F=_%U$ ?%(%!#"=H'?=Z%C%?@A=�!H'?(@# '!=@!C=�!H'?(@# '!=RF"#%("Ba= !H'?(@# '!="%&$? #F=&'!#?'A"=H@AA= !#'=bc=&@#%>'? %"B=?@!> !>=H?'(=@&&%""=&'!#?'A=#'="F"#%(=@!C= !H'?(@d# '!= !#%>? #F�=�E%=QR=S�R�=RG%& @A=[$PA &@# '!=LR[N=e]]dfgB=_%&'((%!C%C=R%&$? #F=�'!#?'A"=H'?=Z%C%?@A=�!H'?(@# '!=RF"#%("Bf=H$?#E%?=C%O=!%"="G%& O=&= !H'?(@d# '!="%&$? #F=&'!#?'A"=H'?=%@&E=&@#%>'?F�h=�E%=C%"&? G# K%=#@PA%"= !=#E "="%&# '!=?%Y=%&#= !H'?(@# '!=H?'(=P'#E=Z�[R=\]]=@!C=S�R�=e]]dfg� i6-6j959-.2+,-./,01klmlnopomqrstmqutvwr9-1;/9262x900y/;-26-z29339:.7{927-3,/56.7,-219:;/7.<2|/,j/65}24-2j9-9/60~256-6j959-.2:,-./,0126119112x�9.�9/����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������a����� ¡ ¢£¤�¥¦§¢©£ª«¦�¬¢­ ®®«¦��ª£¦¡£¢¡�°�¥¬�±�²³³�µ«¦«©¶©�� ­¶¢«ª·� ¹¶«¢ © ¦ª®�§¢�� ¡ ¢£¤�¥¦§¢©£ª«¦�£¦¡�¥¦§¢©£ª«¦��·®ª ©®º�µ£¢­»�²³³¼º�»ªª½¾¿¿­®¢­º¦«®ªºÀ¿½¶Á¤«­£ª«¦®¿Â�½®¿Â�½®²³³¿�¥¬�ò³³ÃÂ�¦£¤Ã©£¢­»º½¡§ºf����Ä¥�Å��½ ­«£¤�¬¶Á¤«­£ª«¦�°�¬±�Ƴ³ÃÇÈ� ­©© ¦¡ ¡�� ­¶¢«ª·�ɦª¢¤®�§¢�� ¡ ¢£¤�¥¦§¢©£ª«¦��·®ª ©®º�� Á¢¶£¢·�²³³Çº�»ªª½¾¿¿­®¢­º¦«®ªºÀ¿½¶Á¤«­£ª«¦®¿¦«®ª½¶Á®¿Æ³³ÃÇÈ¿�¬Æ³³ÃÇȺ½¡§º�h=Ä¥�Å�Ƴ³ÃÇÈ��¥¬��²³³�£¦¡�£¦�£¡¡«ª«¦£¤�½¶Á¤«­£ª«¦��¥¬��ÊËË�°Ì�ª£¦¡£¢¡®�§¢�� ­¶¢«ª·�É£ª  ¢«Í£ª«¦�§�� ¡ ¢£¤�¥¦§¢©£ª«¦�£¦¡�¥¦§¢©£ª«¦��·®ª ©®ºÎ�� Á¢¶£¢·�²³³Ïº�»ªª½¾¿¿­®¢­º¦«®ªºÀ¿½¶Á¤«­£ª«¦®¿Â�½®¿Â�½®ÊËË¿�¥¬�ì�ÐÃÊËËÃÂ�¦£¤º½¡§±�½¢À«¡ �©¶­»�©¢ �¶«¡£¦­ �¦�ª» �¤«®ª ¡�­¦ª¢¤®�ª»£¦�«®�¢ ½¢¡¶­ ¡�«¦�ª»«®�½£½ ¢º�ѧ�½£¢ª«­¶¤£¢�¦ª �£¢ �ª» �ª»¢  �­¦ª¢¤�«©½£­ª�¢£ª«¦®�¢�ÌÁ£® ¤«¦ ®Î�¡ Â�¦ ¡�«¦��¥¬��ÊËË�£¦¡�®½ ­«Â� ¡�§¢�«¦¡«À«¡¶£¤�­¦ª¢¤®�«¦�Ä¥�Å�Ƴ³ÃÇȺ�Å» �Ä¥�Å�¡­¶© ¦ª®�¡�¦ª�®«©½¤·�£®®«¦� £­»�­¦ª¢¤�£�Á£® ¤«¦ Ò�¢£ª» ¢�ª» ·�½¢À«¡ �¶«¡£¦­ �¦�»Ó�­¦ª¢¤®�©¶®ª�Á �«©½¤ © ¦ª ¡�ª�©  ª�ª» �­¢«ª ¢«£�§¢�«¦­¢ £®«¦¤·�®ª¢«¦ ¦ª�¤ À ¤®�§�­¦ª¢¤�Á£® ¤«¦ ®º

Page 15: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-,./0/-1234-1546789:;<=>?@;<ABC>D??:9E<;@;<ABC>@BE>F9?G:<;H>DII9IIJ9B;I>K8DLM5.,-NO,1N4-720P71Q2RNS2T/5N4UNV,66W2,77/7721X/27/VP5N1W2V4-154672N-245.,-NO,1N4-,62N-Y450,1N4-27W71/072142U/1/50N-/2NY21X/2V4-154672,5/2/YY/V1NZ/2N-21X/N52,TT6NV,1N4-[2RNNS2U/Z/64T2,-U2N0T6/0/-12T6,-724Y2,V1N4-2U/7N.-/U2142V455/V12U/\2]VN/-VN/72,-U25/UPV/2452/6N0N-,1/2ZP6-/5,N6N1N/72N-245.,-NO,1N4-,62N-Y450,1N4-27W71/07[2RNNNS2,P1X45NO/21X/24T/5,1N4-24Y245.,-NO,1N4-,62N-Y450,1N4-27W71/072,-U2,-W2,774VN,1/U2N-Y450,1N4-27W71/02V4--/V1N4-7[2,-U2RNZS204-N1452N-Y450,]1N4-27W71/027/VP5N1W2V4-1546724-2,-24-.4N-.2,7N72142/-7P5/21X/2V4-1N-P/U2/YY/V1NZ/-/7724Y21X/2V4-15467_P0 /5a/7V5NT1N4-bcd) 89:;<=>?@;<ABC>D??:9E<;@;<ABC>@BE>F9?G:<;H>DII9IIJ9B;>eAf<?<9I>@BE>e:A?9EG:9Ighijkhlmnopqrosqlphtkukvlwxyhtqxxkzqposkxyhopthwkmqltq{ovv|hmkuqk}x~�wtoskx�h�q�h�lmzovyhtl{�zkpsktyhxk{�mqs|hoxxkxxzkpshopth{kmsq�h{osqlphoptho{{mktqsosqlphwlvq{qkxhsjoshottmkxxhw�mwlxkyhx{lwkyhmlvkxyhmkxwlpxq�qvqsqkxyhopth{lzwvqop{k�hopth�qq�h�lmzovyhtl{�dzkpskthwml{kt�mkxhslh�o{qvqsoskhsjkhqzwvkzkpsosqlphl�hsjkhxk{�mqs|hoxxkxxzkpshopth{kmsq�h{osqlphoptho{{mktqsosqlphwlvq{qkxhopthoxxl{qoskthoxxkxxzkpsyh{kmsq�h{osqlpyhoptho{{mktqsosqlph{lpsmlvx�hbcd� F9?G:<;H>DII9IIJ9B;Ighijkhlmnopqrosqlph{lpt�{sxhophoxxkxxzkpshl�hsjkhxk{�mqs|h{lpsmlvxhqphsjkhqp�lmzosqlphx|xskzh�cxxqnpzkps�hlmnopqrosqlpdtk�hpkth�mk��kp{|yhoshvkoxshopp�ovv|�hslhtkskmzqpkhsjkhk�skpshslh}jq{jhsjkh{lpsmlvxhomkhqzwvkzkpskth{lmmk{sv|yhlwkmosqpnhoxhqpskptktyhopthwmlt�{qpnhsjkhtkxqmkthl�s{lzkh}qsjhmkxwk{shslhzkksqpnhsjkhxk{�mqs|hmk��qmkzkpsxh�lmhsjkhx|xskz�bcd* �B�A:J@;<AB>FHI;9J>8ABB9?;<ABIghijkhlmnopqrosqlpho�sjlmqrkxhovvh{lppk{sqlpxh�mlzhsjkhqp�lmzosqlphx|xskzhslhlsjkmhqp�lmzosqlphx|xskzxhl�sxqtkhl�hsjkho{{mktqsosqlph�l�ptom|hopthzlpqslmx~{lpsmlvxhsjkhx|xskzhqpskm{lppk{sqlpxhlphophlpnlqpnh�oxqx�hcwwmlwmqoskhlmnopqrosqlpovhl��h{qovxhowwmlukhqp�lmzosqlphx|xskzhqpskm{lppk{sqlphonmkkzkpsx�hbcd� F9?G:<;H>89:;<=>?@;<ABghijkhlmnopqrosqlph{lpt�{sxhophoxxkxxzkpshl�hsjkhxk{�mqs|h{lpsmlvxhqphsjkhqp�lmzosqlphx|xskzhslhtkskmzqpkhsjkhk�skpshslh}jq{jhsjkh{lpsmlvxhomkhqzwvkzkpskth{lmmk{sv|yhlwkmosqpnhoxhqpskptktyhopthwmldt�{qpnhsjkhtkxqmkthl�s{lzkh}qsjhmkxwk{shslhzkksqpnhsjkhxk{�mqs|hmk��qmkzkpsxh�lmhsjkhx|xskz�hbcd� ef@B>A�>D?;<AB>@BE>�<f9I;AB9Ighijkhlmnopqrosqlphtkukvlwxhopth�wtoskxh�cxxqnpzkps�hlmnopqrosqlpdtk�hpkth�mk��kp{|�yhohwvophl�ho{sqlphopthzqvkxslpkxh�lmhsjkhqp�lmzosqlphx|xskzhsjoshtl{�zkpsxhsjkhlmnopqrosqlp�xhwvoppktyhqzwvkzkpsktyhopthkuov�oskthmkzktqovho{sqlpxhslh{lmmk{shop|htk�h{qkp{qkxhplsktht�mqpnhsjkhoxxkxxzkpshl�hsjkhxk{�dmqs|h{lpsmlvxhopthslhmkt�{khlmhkvqzqposkh�pl}phu�vpkmo�qvqsqkxhqphsjkhx|xskz�bcd� F9?G:<;H>D??:9E<;@;<ABghijkhlmnopqrosqlpho�sjlmqrkxh�q�k�yho{{mktqsx�hsjkhqp�lmzosqlphx|xskzh�lmhwml{kxxqpnh�k�lmkhlwkmosqlpxhopth�wtoskxhsjkho�sjlmqrosqlph�cxxqnpzkps�hlmnopqrosqlpdtk�hpkth�mk��kp{|��hchxkpqlmhlmnopqrosqlpovhl��h{qovhxqnpxhopthowwmlukxhsjkhxk{�mqs|ho{{mktqsosqlp�bcd� 8AB;<BGAGI>�AB<;A:<B�ghijkhlmnopqrosqlphzlpqslmxhsjkhxk{�mqs|h{lpsmlvxhqphsjkhqp�lmzosqlphx|xskzhlphophlpnlqpnh�oxqx�

Page 16: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-,./0/-1234-1546789:;;<;=>?8@AB5.,-CD,1C4-720E712F/G/64HI2F4JE0/-1I2H/5C4FCJ,66K2EHF,1/I2,-F2C0H6/0/-127/JE5C1K2H6,-72L45245.,-CD,1C4-,62C-L45M0,1C4-27K71/0721N,12F/7J5CO/21N/27/JE5C1K2J4-154672C-2H6,J/2452H6,--/F2L4521N/2C-L450,1C4-27K71/072,-F21N/25E6/724L2O/N,GC452L452C-FCGCFE,672,JJ/77C-.21N/2C-L450,1C4-27K71/07PQE0O/5R/7J5CH1C4-STU) VWXYZ<[\>89:;;<;=>8]9<X\>:;>8Z]XWYZW_abcdaefghijkhljeiamdndoepqramjqqdsjihldqrahimapdfjemjthoouafdnjdvqwxpmhldqyazj{aha|efshorametxsdildmraqdtxfjluapohiijigapeojtualchlahmmfdqqdqapxfpeqdraqtepdrafeodqrafdqpeiqj}jojljdqrahimatespojhitd~ahimazjj{a|efshorametxsdildmapfetdmxfdqalea|htjojlhldalcdajspodsdilhljeiae|alcdaqdtxfjluapohiijigapeojtuahimahqqetjhldmaqdtxfjluapohiijigateilfeoq�STU� V\_[W�>VWXYZ<[\>89:;abcdaefghijkhljeiamdndoepqahimajspodsdilqahaqdtxfjluapohia|efalcdaji|efshljeiaquqldsalchlapfenjmdqahiaendfnjdvae|alcdaqdtxfjluafd�xjfdsdilqa|efalcdaquqldsahimahamdqtfjpljeiae|alcdaqdtxfjluateilfeoqajiapohtdaefapohiidma|efasddljigalceqdafd�xjfdsdilq�a�dqjgihldmae|�atjhoqavjlcjialcdaefghijkhljeiafdnjdvahimahppfendalcdapohi�aSTU� V\_[W�>VWXYZ<[\>89:;>��:[Wabcdaefghijkhljeiafdnjdvqalcdaqdtxfjluapohia|efalcdaji|efshljeiaquqldsa��qqjgisdilyaefghijkhljeiUmd�aidma|fd�xditu�ahimafdnjqdqalcdapohialeahmmfdqqaquqldswefghijkhljeihoatchigdqaefapfe}odsqajmdilj�admamxfjigapohiajspodsdilhljeiaefaqdtxfjluateilfeoahqqdqqsdilq�STU* �Y9W_>]�>�W�:�<]Zabcdaefghijkhljeiadqlh}ojqcdqahimash�dqafdhmjouahnhjoh}odaleahooaji|efshljeiaquqldsaxqdfqahaqdlae|afxodqalchlamdqtfj}dqalcdjfafdqpeiqj}jojljdqahimad�pdtldma}dchnjefavjlcafdghfmaleaji|efshljeiaquqldsaxqhgd�abcdaefghijkhljeiafdtdjndqaqjgidmaht�ievodmgdsdila|fesaxqdfqajimjthljigalchlalcduachndafdhmraximdfqlhimrahimahgfddaleah}jmda}ualcdafxodqae|a}dchnjefra}d|efdahxlcefjkjigahttdqqalealcdaji|efshljeiaquqlds�aSTU� 8Z<�:X\>���:X[>�__W__�W;[abcdaefghijkhljeiateimxtlqahapfjnhtuajsphtlahqqdqqsdilaeialcdaji|efshljeiaquqlds�a�<_�>�__W__�W;[>?��AB5.,-CD,1C4-720E712F/G/64HI2F4JE0/-1I2H/5C4FCJ,66K2EHF,1/I2,-F2C0H6/0/-127/JE5C1K2H6,-72L45245.,-CD,1C4-,62C-L45M0,1C4-27K71/0721N,12F/7J5CO/21N/27/JE5C1K2J4-154672C-2H6,J/2452H6,--/F2L4521N/2C-L450,1C4-27K71/072,-F21N/25E6/724L2O/N,GC452L452C-FCGCFE,672,JJ/77C-.21N/2C-L450,1C4-27K71/07PQE0O/5R/7J5CH1C4-��U) �<_�>�__W__�W;[>8]9<X\>:;>8Z]XWYZW_abcdaefghijkhljeiamdndoepqramjqqdsjihldqrahimapdfjemjthoouafdnjdvqwxpmhldqyazj{aha|efshorametxsdildmafjq�ahqqdqqsdilapeojtualchlahmmfdqqdqapxfpeqdraqtepdrafeodqrafdqpeiqj}jojljdqrahimatespojhitd~ahimazjj{a|efshorametxsdildmapfetdmxfdqalea|htjojlhldalcdajspodsdilhljeiae|alcdafjq�ahqqdqqsdilapeojtuahimahqqetjhldmafjq�ahqqdqqsdilateilfeoq�a��U� VWXYZ<[\>�:[W=]Z<�:[<];abcdaefghijkhljeiathldgefjkdqalcdaji|efshljeiaquqldsahimalcdaji|efshljeiapfetdqqdmraqlefdmraefalfhiqsjlldma}ualcdaquqldsajiahttefmhitdavjlca��S�a)��ahimametxsdilqalcdafdqxolqazjitoxmjigaqxppefljigafhljeihod{ajialcdaquqldsaqdtxfjluapohi�a�dqjgihldmaqdijefUodndoae|�atjhoqavjlcjialcdaefghijkhljeiafdnjdvahimahppfendalcdaqdtxfjluathldgefjkhljeiq�a��U� �<_�>�__W__�W;[abcdaefghijkhljeiateimxtlqahqqdqqsdilqae|alcdafjq�ahimashgijlxmdae|achfsalchlatexomafdqxola|fesalcdaxihxlcefjkdmahttdqqraxqdramjqtoeqxfdramjqfxpljeirasemj�athljeiraefamdqlfxtljeiae|aji|efshljeiahimaji|efshUljeiaquqldsqalchlaqxppeflalcdaepdfhljeiqahimahqqdlqae|alcdahgditu�a

Page 17: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-,./0/-1234-1546789:;<=::>::?>@A<B8=C<DEFGHIGJKLMNO0P/5Q/7R5ST1S4-UVWX 89:;<=::>::?>@AYZ[\]Z_abcdaecbZfbghfeiZaii]iij]beiZkZe\]Z_cilZabgZjabcehg]ZkZ\a_jZe\aeZfhmgZ_]ihmeZk_jZe\]Zhbahe\_cd]gZaff]iinZhi]nZgcifmih_]nZgci_hoecbnZj gcpZfaecbnZ_Zg]ie_hfecbZkZcbk_jaecbZabgZcbk_jaWecbZiqie]jiZe\aeZihoo_eZe\]Zo]_aecbiZabgZaii]eiZkZe\]Za]bfqrZUVW* stu@>vwx9u9Ay<z{w@@9@|YZ}icbZaoo_o_cae]Z~hmb]_a�cmceqZifabbcbZe miZabgZe]f\bc�h]inZe\]Z_abcdaecbZifabiZk_Z~hmb]_a�cmcec]iZcbZe\]Zcbk_jaecbZiqie]jZ�Viicbj]be�Z_abcdaecbWg]pZb]gZk_]�h]bfq�Z_Z�\]bZicbcpZfabeZb]�Z~hmb]_a�cmcec]iZakk]fecbZe\]Ziqie]jZa_]Zcg]becpZ]gZabgZ_]o_e]grZzy:A>?<w@�<z>v�9{>:<={�t9:9A9�@<Bz=C�5.,-S�,1S4-720O71�2�S�2,664R,1/27O��2RS/-125/74O5R/72142,�/�O,1/6�2T541/R1245.,-S�,1S4-,62S-�450,1S4-27�71/07�2�SS�2/0T64�27�71/02�/�/64T0/-126S�/2R�R6/2T54R/77/721�,12S-R45T45,1/2S-�450,1S4-27/RO5S1�2R4-7S�/5,1S4-7�2�SSS�2/0T64�274�1�,5/2O7,./2,-�2S-71,66,1S4-25/715SR1S4-7�2,-�2�S��2/-7O5/21�,121�S5��T,51�2T54�S�/572/0T64�2,�/�O,1/27/RO5S1�20/,7O5/72142T541/R12S-�450,1S4-�2,TT6SR,1S4-7�2,-��4527/5�SR/724O174O5R/�2�54021�/245.,-S�,1S4-�NO0P/5Q/7R5ST1S4-�VW) zy:A>?<w@�<z>v�9{>:<={�t9:9A9�@<��u9{y<w@�<�v�{>�tv>:YZ[\]Z_abcdaecbZg]~]moinZgcii]jcbae]inZabgZo]_cgcWfammqZ_]~c]�i�hogae]i�Z�c�ZaZk_jamnZgfhj]be]gnZiqie]jZabgZi]_~cf]iZaf�hcicecbZomcfqZe\aeZagg_]ii]iZoh_oi]nZifo]nZ_m]inZ_]iobic�cmcec]inZabgZfjomcabf] ZabgZ�cc�Zk_jamnZgfhj]be]gZo_f]gh_]iZeZkafcmceae]Ze\]Zcjom]j]beaWecbZkZe\]Ziqie]jZabgZi]_~cf]iZaf�hcicecbZomcfqZabgZaiifcae]gZiqie]jZabgZi]_~cf]iZaf�hcicecbZfbe_mirZ�VW¡ =uu�{wA9�@<�¢<8>:�tv{>:YZ[\]Z_abcdaecbZg]e]_jcb]inZgfhj]beinZabgZammfae]iZaiZoa_eZkZceiZfaoceamZomabbcbZabgZcb~]iej]beZfbe_mZo_f]iiZe\]Z_]ih_f]iZ_]�hc_]gZeZag]�hae]mqZo_e]feZe\]Zcbk_jaecbZiqie]jrZ�VW£ ¤9¢><¥y{u><zt¦¦�vAYZ[\]Z_abcdaecbZjaba]iZe\]Zcbk_jaecbZiqie]jZhicbZaZiqie]jZg]~]moj]beZmck]Zfqfm]Zj]e\gm qZe\aeZcbfmhg]iZcbk_jaecbZi]fh_ceqZfbicg]_aecbirZ�VWX ={�t9:9A9�@:YZ[\]Z_abcdaecbZcbfmhg]iZi]fh_ceqZ_]�hc_]j]beiZabg�_Zi]fh_ceqZio]fcpZfaecbinZ]ce\]_Z]§omcfcemqZ_Z�qZ_]k]_]bf]nZcbZcbk_jaecbZiqie]jZaf�hcicecbZfbe_afeiZ�ai]gZbZabZaii]iij]beZkZ_cilrZ�VW* @¢�v?wA9�@<zy:A>?<©�{t?>@AwA9�@YZ[\]Z_abcdaecbZ]bih_]iZe\aeZag]�hae]Zgfhj]beaecbZk_Ze\]Zcbk_jaecbZiqie]jZabgZceiZfbieceh]beZfjob]beiZciZa~acma�m]nZo_e]fe]gZ�\]bZ_]�hc_]gnZabgZgcie_c�he]gZeZahe\_cd]gZo]_ibb]mrZ�VWª z�¢A«wv><¬:w|><8>:Av9{A9�@:Y<[\]Z_abcdaecbZfjomc]iZ�ce\Zike�a_]Zhia]Z_]ie_cfecbirZ�VW­ ¬:>v<@:Awuu>�<z�¢A«wv>YZ[\]Z_abcdaecbZ]bk_f]iZ]§omcfceZ_hm]iZ ~]_bcbZe\]Zg�bmagcbZabgZcbieammaecbZkZike�a_]Z�qZhi]_irZ�VW® z>{tv9Ay<©>:9|@<�v9@{9¦u>:YZ[\]Z_abcdaecbZg]icbiZabgZcjom]j]beiZe\]Zcbk_jaecbZiqie]jZhicbZi]fh_ceqZ]bcb]]_cbZo_cbfcom]irZ

Page 18: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./012341+/5678/-198:;7-7.7<31=+9>1?@ABCDBEFGHIJKLMNOMPQNRSTRUVWXYZ [;.-<;58/41\3]<502.7<31+,-./01+/5678/-_ab_cdefghifjhcg_bgkldbk_jafj_jahdmYnfdjo_ndcphmbdk_cq_hgqcdrfjhcg_kokjbr_kbdphsbk_brntco_fmbulfjb_kbsldhjo_scgjdctk_hg_fsscdmfgsb_vhja_fnnthsfwtb_qbmbdft_tfvkx_mhdbsjhpbkx_ncthshbkx_dbeltfjhcgkx_kjfgmfdmkx_elhmfgsbx_fgm_bkjfwthkabm_kbdphsb_tbpbt_fedbbrbgjky_ab_cdefghifjhcg_rcghjcdk_kbsldhjo_scgjdct_scrnthfgsby_WXY)z {/6/|<}/51~<3�1�;52.7<31�232�/0/3._ab_hgqcdrfjhcg_kokjbr_mbpbtcnbd_sdbfjbk_fgm_hrntbrbgjk_f_scg�_eldfYjhcg_rfgfebrbgj_ntfg_jafj_scgjdctk_safgebk_jc_jab_kokjbr_mldhge_mbpbtcnrbgjx_jdfs�k_kbsldhjo_�_fvkx_dbulhdbk_fljacdhifjhcg_cq_safgebkx_fgm_ndcphmbk_mcslrbgjfjhcg_cq_jab_ntfg_fgm_hjk_hrntbrbgjfjhcgy_WXY)) {/6/|<}/51+/8;57.,1�/-.73�_ab_hgqcdrfjhcg_kokjbr_mbpbtcnbd_sdbfjbk_f_kbsldhjo_jbkj_fgm_bpftlfjhcg_ntfgx_hrntbrbgjk_jab_ntfgx_fgm_mcslrbgjk_jab_dbkltjky_�bpbtcnrbgjft_kbsldhjo_jbkj_dbkltjk_rfo_wb_lkbm_hg_klnncdj_cq_jab_kbsldhjo_sbdjh�_sfjhcg_fgm_fssdbmhjfjhcg_ndcsbkk_qcd_jab_mbthpbdbm_hgqcdrfjhcg_kokjbry_��V��MKMVT��UVTNU�P�SMN�TRUV����UVTNU�P[}/52.7<32|18<3.5<|-1%!"$�%�#�%�%��%&# �%��%��'�(�!&%�'��#�%� !�'�(�# '!�"%&$� #����'���(����%��# '!���&'!�#�'�"��""%""���%#�%�����'!#�'�"�%� "#�#'�(%%#��%�$��#'����%�$ �%(%!#"����$�%"��! ��%�$ �%(%!#"�%� "#��! ���%� '&$(%!#% ��¡#�����%��'�(�!&%������ "��"���%�&'(��%#% ��%�$�������¡$�%�� "'����%� %��'��¢%��(�!��%(%!#��%�'�#"��! �'�%��# !���%"$�#"�'&&$�"��%�$�������£¤¥¦£§£¥©ª¦¥«¬­®¬¥©ª¦¥«£¥°§¦±²¥©£¥³£±©³¥¦§ª±¥©£²µ¦±ª®£¦¶µ«§ª±¥©²£§©·£²ª§©·§¦·²£² £¹º»±¼²£½©±¾£·£»¥°«±§© £¿¦¥Àª£ºÁ©±§«£Â µ¦±ª®£»¥©ª¦¥«£Ã§ª¦±ÄÅ£Áªª°ÆÇÇÈÈÈűª±©²ª±ªµªÅ¥Çµ°Ç±°§ªÉ¥©Å§²°Äʱ·ËÌÅ£

Page 19: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123/456230.24789:;<=<>>?:=@?A;:B=B=C?D8AE+.F/31G/012375HI70J5K1L5-37I.-50M/05H/3/F-.75/3N5I7-.752O52.F/31G/0123/4513O2.H/012357P70-H75/.-5H/N-5/Q/.-52O50M-57-RI.10P5.17S75/772R1/0-N5Q10M50M-1.5/R01T101-75/3N52O50M-5/,,41R/U4-54/Q7V5WX-RI01T-5+.N-.7V5N1.-R01T-7V5,241R1-7V570/3N/.N7V51370.IR01237V5.-FI4/01237V52.5,.2R-NI.-75.-4/0-N50250M-57-RI.10P52O52.F/31G/0123/4513O2.H/012357P70-H7Y5/3N5K11L5-37I.-50M/052.F/31G/0123/45,-.7233-45/.-5/N-ZI/0-4P50./13-N5025R/..P52I050M-1.5/771F3-N513O2.H/012357-RI.10P[.-4/0-N5NI01-75/3N5.-7,2371U14101-7\5]IHU-. -7R.1,0123_a) b<cd;Bef?89:;<=<>>?:=@?A;:B=B=C?ghiBcf?:=@?g;hc<@d;<>jklmknopqrstqusnrkvmwmxnyz{kvszzm|srqumz{kqrvkymosanvs}qxx~komwsm�z��yvqumz�k�s�kqk�no|qx{kvn}�|mrumv{kzm}�osu~kq�qomrmzzkqrvkuoqsrsrpkynxs}~kulqukqvvomzzmzky�oynzm{kz}nym{konxmz{komzynrzs�sxsusmz{kqrvk}n|yxsqr}m�kqrvk�ss�k�no|qx{kvn}�|mrumvkyon}mv�omzkunk�q}sxsuqumkulmks|yxm|mruqausnrkn�kulmkzm}�osu~kq�qomrmzzkqrvkuoqsrsrpkynxs}~kqrvkqzzn}squmvkzm}�osu~kq�qomrmzzkqrvkuoqsrsrpk}nruonxz�k_a� b<cd;Bef?89:;<=<>>jklmknopqrstqusnrkmrz�omzkqxxk�zmozk�sr}x�vsrpk|qrqpmozkqrvkzmrsnokm�m}�uswmz�kqomkm�ynzmvkunk�qzs}ksr�no|qusnrkz~zum|kzm}�osu~kq�qomrmzzk|qumosqxzk�m�nomkq�ulnostsrpkq}}mzzkunkulmkz~zum|kqrvk�nopqrstqausnravm�krmvk�om��mr}~{kqukxmqzukqrr�qxx~�kulmomq�umo�_a� b<cd;Bef?A;:B=B=Cjklmknopqrstqusnrksvmrus�kmzkymoznrrmxk�sulkzsprs�k}qruksr�no|qusnrkz~zum|kzm}�osu~konxmzkqrvkomzynrzs�sxsusmz{kvn}�|mruzkulnzmkonxmzkqrvkomzynrzs�sxsusmz{kqrvkyonwsvmzkqyyonyosqumksr�no|qusnrkz~zum|kzm}�osu~kuoqsrsrpk�m�nomkq�ulnostsrpkq}}mzzkunkulmkz~zum|kqrvk�nopqrstqusnravm�krmvk�om��mr}~�kulmomq�umo�k_a� b<cd;Bef?A;:B=B=C?�<ch;@>jklmknopqrstqusnrkvn}�|mruzkqrvk|nrsunozksrvswsv�qxksr�no|qusnrkz~zum|kzm}�osu~kuoqsrsrpkq}uswsusmzksr}x�vsrpk�qzs}kzm}�osu~kq�qomrmzzkuoqsrsrpkqrvkzym}s�k}ksr�no|qusnrkz~zum|kzm}�osu~kuoqsrsrp�k�h=�?Cd;:eBh=?�:=:C<�<=e?D��E+.F/31G/012375HI70J5K1L5-70/U417M5/3N5H/130/135U/7-413-5R23�5FI./012375/3N513T-302.1-752O52.F/31G/0123/4513O2.H/012357P70-H75K13R4IN13F5M/.NQ/.-V572O0Q/.-V5�5.HQ/.-V5/3N5N2RIH-30/0123L50M.2IFM2I050M-5.-7,-R01T-57P70-H5N-T-42,[H-30541O-5RPR4-7Y5/3N5K11L5-70/U417M5/3N5-3O2.R-57-RI.10P5R23�5FI./012357-0013F75O2.513O2.H/012350-RM3242FP5,.2NIR075-H,42P-N51352.F/31G/0123/4513O2.H/012357P70-H7\]IHU-. -7R.1,0123��a) �h=�?Cd;:eBh=?�:=:C<�<=e?ghiBcf?:=@?g;hc<@d;<>jklmknopqrstqusnrkvmwmxnyz{kvszzm|srqumz{kqrvkymosnvs}qxx~komwsm�z��yvqumz�k�s�kqk�no|qx{kvn}�|mrumv{k}nr�kp�oqusnrk|qrqpm|mrukynxs}~kulqukqvvomzzmzky�oynzm{kz}nym{konxmz{komzynrzs�sxsusmz{kqrvk}n|yxsqr}m�kqrvk�ss�k�no|qx{kvn}�|mrumvkyon}mv�omzkunk�q}sxsuqumkulmks|yxm|mruqusnrkn�kulmk}nr�kp�oqusnrk|qrqpm|mrukynxs}~kqrvkqzzn}squmvk}nr�kp�oqusnrk|qrqpm|mruk}nruonxz�k��a� �:><iB=<?�h=�?Cd;:eBh=jklmknopqrstqusnrkvmwmxnyz{kvn}�|mruz{kqrvk|qsruqsrzkqk}�oomru{k�qzmxsrmk}nr�kp�oqusnrkn�kulmksr�no|qusnrkz~zum|kqrvkqrksrwmruno~kn�kulmkz~zum|�zk}nrzusu�mruk}n|ynrmruz�k��a� �h=�?Cd;:eBh=?��:=C<?�h=e;hij?lmknopqrstqusnrkvn}�|mruzkqrvk}nruonxzk}lqrpmzkunkulmksr�no|qusnrkz~zum|�k_yyonyosqumknopqrstqusnrqxkn��k}sqxzkqyyonwmksr�no|qusnrkz~zum|k}lqrpmzksrkq}}novqr}mk�sulknopqrstqusnrqxkynxs}smzkqrvkyon}mv�omz�k��a� �h=Beh;B=C?�h=�?Cd;:eBh=?��:=C<>jklmknopqrstqusnrk|nrsunozk}lqrpmzkunkulmksr�no|qusnrkz~zum|kqrvk}nrav�}uzkzm}�osu~ks|yq}ukqrqx~zmzkunkvmumo|srmkulmkm��m}uzkn�kulmk}lqrpmz�k

Page 20: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123/456230.24789:;<=>?@AB9:<C@:@=DED:A<F8CG<HIJKLMKNOPQRSTU-.V-7W.1,0123XYZ[ \]]D <_DA?B]AB9:<9?<8a@:=Db<cdefghijklmjnlgkfekoghpeqfjppeqqfheqnhlpnlgkqfjqqgpljnerfslndfpdjkieqfngfndeflkoghtjnlgkfquqnetvfXYZw 89:;<=>?@AB9:<xDAAB:=b<cdefghijklmjnlgkfpgkyfizheqfndefqepzhlnufqennlkiqfgoflkoghtjnlgkfnepdkg{giuf|hgrzpnqfngfndeftgqnfheqnhlpnl}eftgrefpgkqlqneknfslndflkoghtjnlgkfquqnetfg|ehjnlgkj{fhe~zlheteknqvfXYZ� �D@A<�>:]AB9:@�BA�bfcdefghijklmjnlgkfpgkyfizheqfndeflkoghtjnlgkfquqnetfngf|hg}lrefgk{ufeqqeknlj{fpj|j�l{lnleqfjkrfq|eplyfpj{{uf|hgdl�lnqfjkr�ghfheqnhlpnqfndefzqefgofndefog{{gslkifozkpnlgkq�f|ghnq�f|hgngpg{q�fjkr�ghfqeh}lpeq�f��qqliktekn�fghijklmjnlgkZreyfkerf{lqnfgof|hgdl�lnerfjkr�ghfheqnhlpnerfozkpnlgkq�f|ghnq�f|hgngpg{q�fjkr�ghfqeh}lpeq�vf89:AB:=D:]�<��@::B:=<F8�G+.�/31�/012375TS705-70/U417��5T/130/13�5/3�5-��-W01�-4�51T,4-T-305,4/375�2.5-T-.�-3W�5.-7,237-�5U/W�S,52,-./�01237�5/3�5,270��17/70-.5.-W2�-.�5�2.52.�/31�/0123/4513�2.T/012357�70-T75025-37S.-50�-5/�/14/U1410�52�5W.101W/4513�2.T/�01235.-72S.W-75/3�5W23013S10�52�52,-./012375135-T-.�-3W�5710S/01237�5RSTU-.V-7W.1,0123X�Z) 89:AB:=D:]�<��@::B:=<�9�B]�<@:�<�?9]D�>?Dbfcdefghijklmjnlgkfre}e{g|q�frlqqetlkjneq�fjkrf|ehlgrlpj{{ufhe}lesq�z|rjneq�f�l�fjfoghtj{�frgpztekner�fpgknlkiekpuf|{jkklkif|g{lpufndjnfjrrheqqeqf|zh|gqe�fqpg|e�fhg{eq�fheq|gkql�l{lnleq�fjkrfpgt|{ljkpe�fjkrf�ll�foghtj{�frgpzteknerf|hgperzheqfngfojpl{lnjnefndeflt|{eteknjnlgkfgofndefpgknlkiekpuf|{jkklkif|g{lpufjkrfjqqgpljnerfpgknlkiekpuf|{jkklkifpgknhg{qvX�Z� 89:AB:=D:]�<��@:bfcdefghijklmjnlgkfre}e{g|qfjkrflt|{eteknqfjfpgknlkiekpuf|{jkfoghfndeflkoghtjnlgkfquqnetfjrrheqqlkifpgknlkiekpufhg{eq�fheq|gkql�l{lnleq�fjqqlikerflkrl}lrzj{qfslndfpgknjpnflkoghtjnlgk�fjkrfjpnl}lnleqfjqqgplZjnerfslndfheqnghlkifndefquqnetfjonehfjfrlqhz|nlgkfghfojl{zhevf�eqlikjnerfgoyfplj{qfslndlkfndefghijklmjnlgkfhe}lesfjkrfj||hg}efndefpgknlkiekpuf|{jkfjkrfrlqnhl�znefpg|leqfgofndef|{jkfngf�eufpgknlkiekpuf|ehqgkke{vX�Z� 89:AB:=D:]�< ?@B:B:=bfcdefghijklmjnlgkfnhjlkqf|ehqgkke{flkfndelhfpgknlkiekpufhg{eqfjkrfheq|gkql�l{lnleqfslndfheq|epnfngfndeflkoghtjnlgkfquqnetfjkrf|hg}lreqfheoheqdehfnhjlklkif��qqliktekn�fghijklmjnlgkZreyfkerfohe~zekpu�fjnf{ejqnfjkkzj{{u�vX�Z¡ 89:AB:=D:]�<��@:< DAB:=bfcdefghijklmjnlgkfneqnqfndefpgknlkiekpuf|{jkfoghfndeflkoghtjnlgkfquqnetf��qqliktekn�fghijklmjnlgkZreyfkerfohe~zekpu�fjnf{ejqnfjkkzj{{u�fzqlkif��qqliktekn�fghijklmjnlgkZreyfkerfneqnqfjkrfe¢ehplqeq�fngfrenehtlkefndef|{jk£qfeooepnl}ekeqqfjkrfndefghijklmjnlgk£qfhejrlkeqqfngfe¢epznefndef|{jkvf�||hg|hljnefgoyfplj{qfslndlkfndefghijklmjnlgkfhe}lesfndefpgknlkiekpuf|{jkfneqnfheqz{nqfjkrflklnljnefpghhepnl}efjpnlgkqvX�Z[ 89:AB:=D:]�<��@:<¤¥�@ADbfcdefghijklmjnlgkfhe}lesqfndefpgknlkiekpuf|{jkfoghfndeflkoghtjnlgkfquqnetf��qqliktekn�fghijklmjnlgkZreyfkerfohe~zekpu�fjnf{ejqnfjkkzj{{u�fjkrfhe}lqeqfndef|{jkfngfjrrheqqfquqnet�ghijklmjZnlgkj{fpdjkieqfghf|hg�{etqfekpgzkneherfrzhlkif|{jkflt|{eteknjnlgk�fe¢epznlgk�fghfneqnlkivX�Zw \�AD?:@AD<xA9?@=D<xBADbfcdefghijklmjnlgkflreknlyfeqfjkfj{nehkjnefqnghjiefqlnefjkrflklnljneqfkepeqqjhufjiheeteknqfngf|ehtlnfndefqnghjiefgoflkoghtjnlgkfquqnetf�jp�z|flkoghtjnlgkvX�Z� \�AD?:@AD<�?9]D B:=<xBADbfcdefghijklmjnlgkflreknlyfeqfjkfj{nehkjnef|hgpeqqlkifqlnefjkrflklnljneqfkepeqqjhufjiheeZteknqfngf|ehtlnfndefheqzt|nlgkfgoflkoghtjnlgkfquqnetfg|ehjnlgkqfoghfphlnlpj{ftlqqlgk��zqlkeqqfozkpnlgkqfslndlkf��qqliktekn�fghijklmjnlgkZreyfkerfnltef|ehlgr�fsdekfndef|hltjhuf|hgpeqqlkifpj|j�l{lnleqfjhefzkj}jl{j�{ev

Page 21: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./-01-234567--/-048+594:;<=>?=@ABCDEFGHIJHKLIMNOMPQRSTU V1612,WWX-/27./,-Y4Z1[\/21Y]_abcdefgheigbfgjafigkalmcgnecoefjepiacfeiaiapaqbnnrfgqeigbfllacsgqaliblrmmbciiagftbcneigbflolianefjgfgigeialfaqallecoedcaanafilibmacngiiacalrnmigbfbtlolianbmaceigbfltbcqcgigqepngllgbfuvrlgfalltrfqigbflwgigfxyllgdfnafizbcdefgheigbfTjakfajignamacgbj{w afiamcgnecoiapaqbnnrfgqeigbflqemevgpgigalecarfesegpevpa|RST* }-~,[W7./,-4Z3Y.1W4�72�X�z_abcdefgheigbfqbfjrqilveq�rmlbtrlacTpasapefjlolianTpasapgftbcneigbf�gfqprjgfdlolianlieiagftbcneigbf�qbfiegfajgfiagftbcneigbflolianxyllgdfnafizbcdefgheigbfTjakfajtcaT�rafqo{efjlibcalveq�rmgftbcneigbfeiefemmcbmcgeiapolaqrcajpbqeigbf|RST)� }-~,[W7./,-4Z3Y.1W4�12,\1[347-�4�12,-Y./.X./,-z_abcdefgheigbfanmpbolnaqefglnlwgi lrmmbcigfdmcbqajrcalibeppbwiagftbcneigbflolianibvacaqbsacajefjcaqbfligiriajibialolian�lbcgdgfeplieiaetiacejglcrmigbfbctegprca|�NHI�OMPQ����PQOIP�K}-2/�1-.4�1Y�,-Y148}�9�I��QM��OMPQK�FEKO���M��HKO�G�MK���Q�PNHI�OMPQ���MQLM�HQO���Q��MQ��L�N�GM�MO���PI�PI��QM��OMPQ���MQ�PIF�OMPQ�K�KOHFK�O��O�MQL�E�HK���H�E�OH�NIHN�I�OMPQ���HOHLOMPQ���Q���KMK��LPQO�MQFHQO��IHLP�HI����Q��EKHI�IHKNPQKH��LOM�MOMHK���Q���MM��OI�L����PLEFHQO���Q��IHNPIO�MQLM�HQOK�OP��NNIPNIM�OH�PI��QM��OMPQ���P���LM��K��Q��PI��EO�PIMOMHK�DEFGHIJHKLIMNOMPQ ¡T) }-2/�1-.4�1Y�,-Y145,6/2347-�45[,21�X[1Y]4_abcdefgheigbfjasapbml¢jgllangfeial¢efjmacgbjgqeppocasgawlurmjeialz�g�etbcnep¢jbqrnafiaj¢gfqgjaficalmbflambpgqoieiejjcallalmrcmbla¢lqbma¢cbpal¢calmbflgvgpgigal¢efjqbnmpgefqa£efj�gg�tbcnep¢jbqrnafiajmcbqajrcalibteqgpgieiaiagnmpanafieigbfbtiagfqgjaficalmbflambpgqoefjellbqgeiajgfqgjaficalmbflaqbficbpl| ¡T¤ }-2/�1-.4�1Y�,-Y14V[7/-/-0]_abcdefgheigbficegflmaclbffapgfiagcgfqgjaficalmbflacbpalefjcalmbflgvgpgTigalwgi calmaqiibiagftbcneigbflolianefjmcbsgjalcatcalacicegfgfdxyllgdfnafizbcdefgheigbfTjakfajtca�rafqo¢eipaelieffreppo{| ¡T¥ }-2/�1-.4�1Y�,-Y14V1Y./-0]4_abcdefgheigbfialiliagfqgjaficalmbflaqemevgpgiotbciagftbcneigbflolianxyllgdfnafizbcdefgheigbfTjakfajtca�rafqo¢eipaelieffreppo{rlgfdxyllgdfnafizbcdefgheigbfTjakfajialilefja¦acqglal{ibjaiacngfaiagfqgjaficalmbflaattaqigsafallefjjbqrnafiliacalrpil| ¡T§ }-2/�1-.47-�6/-0]_abcdefgheigbfgnmpanafilefgfqgjafiefjpgfdqemevgpgiotbclaqrcgiogfqgjafilieigfqprjalmcameceigbf¢jaiaqigbfefjefepolgl¢qbfiegfnafi¢acejgqeigbf¢efjcaqbsaco| ¡T© }-2/�1-.4ª,-/.,[/-0]_abcdefgheigbficeq�lefjjbqrnafilgftbcneigbflolianlaqrcgiogfqgjafilbfefbfdbgfdvelgl| ¡T« }-2/�1-.4�1�,[./-0z_abcdefgheigbfmcbnmipocambcilgfqgjafigftbcneigbfibemmcbmcgeiaeribcgigal| ¡T¬ }-2/�1-.4�1Y�,-Y14­YY/Y.7-21]_abcdefgheigbfmcbsgjalefgfqgjaficalmbflalrmmbcicalbrcqaieibttaclejsgqaefjellgliefqaibrlaclbtiagftbcneigbfloliantbcia efjpgfdefjcambcigfdbtlaqrcgiogfqgjafil|_alrmmbcicalbrcqaglefgfiadcepmecibtiabcdefgheigbf�lgfqgjaficalmbflaqemevgpgio|

Page 22: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123/456230.24789:;<=;9;>=?@8AB+.C/31D/012375EF70G5H1I5,-.J2.E5,-.12K1L5/3K501E-4M5E/130-3/3L-52352.C/31D/0123/4513J2.E/012357M70-E7N5/3K5H11I5,.2O1K-5-JJ-L01O-5L230.24752350P-502247Q50-LP31RF-7Q5E-LP/317E7Q5/3K5,-.7233-45F7-K5025L23KFL0513J2.E/012357M70-E5E/130-3/3L-STFEU-.V-7L.1,0123WXYZ [\]<= ?89:;<=;9;>=?_a:>\?9;b?_c>=bdc=]e?fghijklmnopmqojnirhshtjuvwirovvhxonmqhvwimnriuhkojroymttzikhsoh{v|}urmqhv~i�o�imi�jkxmtwirjy}xhnqhrwion�jkxmqojnivzvqhxixmonqhnmnyhiujtoyziqgmqimrrkhvvhviu}kujvhwivyjuhwikjthvwikhvujnvo�otoqohvwimnriyjxutomnyh�imnri�oo�i�jkxmtwirjy}xhnqhriukjyhr}khviqji�myotoqmqhiqghioxuthxhnqmqojnij�iqghion�jkxmqojnivzvqhxixmonqhnmnyhiujtoyzimnrimvvjyomqhrivzvqhxixmonqhnmnyhiyjnqkjtv�iWXY) _=c:b:>?89:;<=;9;>=eifghijklmnopmqojnivyghr}thvwiuhk�jkxvwimnrirjy}xhnqvikj}qonhiukhshnqmqoshimnrikhl}tmkixmonqhnmnyhijniqghiyjxujnhnqvij�iqghion�jkxmqojnivzvqhxionimyyjkrmnyhi{oqgixmn}�myq}khkijkishnrjkivuhyo�iymYqojnvimnr|jkijklmnopmqojnmtikh�}okhxhnqv�iWXY� 89:;<=;9;>=?� a]eifghijklmnopmqojnimuukjshvwiyjnqkjtvwimnrixjnoqjkviqghi}vhij�ion�jkxmqojnivzvqhxixmonqhYnmnyhiqjjtvimnrixmonqmonviqghiqjjtvijnimnijnljonli�mvov�iWXY� �= <=?89:;<=;9;>=eifghijklmnopmqojnimuukjshvwiyjnqkjtvwimnrixjnoqjkvikhxjqhtzih�hy}qhrixmonqhnmnyhimnriromlnjvqoyimyqosoqohv�iWXY� 89:;<=;9;>=?_=c];;=ae?fghijklmnopmqojnixmonqmonvimitovqij�iuhkvjnnhtim}qgjkophriqjiuhk�jkxixmonqhnmnyhijniqghion�jkxmqojnivzvqhx�i�ntzim}qgjkophriuhkvjnnhtiuhk�jkxixmonqhnmnyhijniqghion�jkxmqojnivzvqhx�iWXY� �:=a\?89:;<=;9;>=eifghijklmnopmqojnij�qmonvixmonqhnmnyhiv}uujkqimnrivumkhiumkqvi�jki�Xvvolnxhnq~ijklmnopmqojnYrh�inhritovqij�i�hzion�jkxmqojnivzvqhxiyjxujnhnqv�i{oqgoni�Xvvolnxhnq~ijklmnopmqojnYrh�inhriqoxhiuhkojr�ij�i�mot}kh�8=b:9?_c<=><:;?@8_B+.C/31D/012375EF70G5H1I5,.20-L0513J2.E/012357M70-E5E-K1/Q5U20P5,/,-.5/3K5K1C10/4N5H11I541E105/LL-77502513J2.E/0123523513J2.E/012357M70-E5E-K1/5025/F0P2.1D-K5F7-.7N5/3K5H111I57/3101D-52.5K-70.2M513J2.E/012357M70-E5E-K1/5U-J2.-5K17,27/452.5.-4-/7-5J2.5.-F7-S5TFEU-.V-7L.1,0123W�YZ 8=b:9?_c<=><:;?_a:>\?9;b?_c>=bdc=]eifghijklmnopmqojnirhshtjuvwirovvhxonmqhvwimnriuhkojroymttzikhsoh{v|}urmqhv~i�o�imi�jkxmtwirjy}xhnqhrwixhromiukjqhyqojniujtoyziqgmqimrrkhvvhviu}kujvhwivyjuhwikjthvwikhvujnvo�otoqohvwimnriyjxutomnyh�imnri�oo�i�jkxmtwirjy}xhnqhriukjyhr}khviqji�myotoqmqhiqghioxuthxhnqmqojnij�iqghixhromiukjqhyqojniujtoyzimnrimvvjyomqhrixhromiukjqhyqojniyjnqkjtv�iW�Y) 8=b:9?A>>=]]eifghijklmnopmqojnihnv}khviqgmqijntzim}qgjkophri}vhkvigmshimyyhvviqjion�jkxmqojnioniukonqhri�jkxijkijniroloqmtixhromikhxjshri�kjxiqghion�jkxmqojnivzvqhx�iW�Y� 8=b:9?�9�=a:;�eifghijklmnopmqojnim��i�hvih�qhknmtitm�htviqjikhxjsm�thion�jkxmqojnivqjkmlhixhromimnrion�jkxmqojnivzvqhxij}qu}qionroymqonliqghirovqko�}qojnitoxoqmqojnvimnrigmnrtonliymshmqvij�iqghion�jkxmqojn�ifghijklmnopmqojnih�hxuqviqghi�jttj{onlivuhyo�iyiqzuhvij�ixhromijkigmkr{mkhiyjxujnhnqvi�kjxitm�htonlivjitjnlimviqghzikhxmoni{oqgonimivhy}khihnsokjnxhnq~i�Xvvolnxhnq~ijklmnopmqojnYrh�inhritovqij�ixhromiqzuhvimnrigmkr{mkhiyjxujnhnqv��iW�Y� 8=b:9?[<c9�=eifghijklmnopmqojniugzvoymttziyjnqkjtvimnrivhy}khtzivqjkhvion�jkxmqojnivzvqhxixhromwi�jqgiumuhkimnriroloqmtwi�mvhrijniqghigolghvqi����iZ��ivhy}koqziymqhljkzij�iqghion�jkxmqojnikhyjkrhrijniqghixhrom�i

Page 23: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./01234,54.3607+1809:;<=><?@ABCDEFGHIGJKHLMNLOPQRST +,-./0U2/6VW324XYZ[\Y]_abcdb]aYe]ad]fgYbah]i db]aYgjgd\iYi\kbYlmm\YakYkb_bdfnYakY\gdbedgYd[\YmbeopmqY\e\bmdqYdagh\qYakYk\fbr\jY]hYgpe[Yi\kbYd]Ypd[]bc\kYm\g]aa\fsYQRSt +,-./0u/6.4.v/4.36XYZ[\Y]_abcdb]aYgabdbc\gYbah]i db]aYgjgd\iYkb_bdfYi\kbYpgba_Ymm]r\kY\wpbmi\adqYd\e[Sabwp\gqYakYm]e\kp\gsYZ[\Y]_abcdb]aYdeogqYk]epi\adgqYakYr\bxY\gYi\kbYgabdbcdb]aYedb]agYakYm\b]kbeffjYd\gdgYgabdbcdb]aY\wpbmi\adym]e\kp\gYd]Y\agp\Ye] \edYm\h]i ae\sYQRSz +,-./0{,V42|54.360/6-0{.VW3V/}XYZ[\Y]_abcdb]aYgabdbc\gY]Yk\gd]jgYbah]i db]aYgjgd\iYkb_bdfYi\kbY~\h]\YbdgYkbgm]gfY]Y\f\g\Yh]Y\pg\qYd]Ym\r\adYpapd[]bc\kYbakbrbkpfgYh]iY_baba_Yee\ggYd]YakYpgba_Yd[\Ybah]i Sdb]aYe]adba\kY]aYd[\Yi\kbsY�MGH�NLOP����OPNHO�J1��V.5/}0/6-0�6�.236�,64/}01234,54.36071�8�H��PL��NLOPJ�EDJN���L���LELN�M��JLK����KKGJJ�NO�LP�OHE�NLOP�J�JNGEJ��G�DLMEGPN���P��N�G�HGJMGKNL�G�OMGH�NLP��GP�L�HOPEGPNJ�NO��DN�OHL�G��LP�L�L�D��J���LL��MHONGKN�N�G�M��JLK���M��PN��P��JDMMOHN�LP�H�JNHDKNDHG��OH�LP�OHE�NLOP�J�J�NGEJ���LLL��MHO�L�G�JDMMOHNLP��DNL�LNLGJ��OH�LP�OHE�NLOP�J�JNGEJ���L���MHONGKN�LP�OHE�NLOP�J�JNGEJ����LPJN�GP�LHOPEGP�N�������H�J���P������MHO�L�G��MMHOMHL�NG�GP�LHOPEGPN���KOPNHO�J�LP���KL�LNLGJ�KOPN�LPLP��LP�OHE�NLOP�J�JNGEJ�CDEFGHIGJKHLMNLOPR�S* 1��V.5/}0/6-0�6�.236�,64/}01234,54.36013}.5�0/6-01235,-|2,VXYZ[\Y]_abcdb]aYk\r\f]mgqYkbgg\ibad\gqYakYm\b]kbeffjY\rb\�gypmkd\g�YlbnYYh]i fqYk]epi\ad\kqYm[jgbefYakY\arb]ai\adfYm]d\edb]aYm]fbejYd[dYkk\gg\gYmpm]g\qYge]m\qY]f\gqY\gm]agb~bfbdb\gqYakYe]imfbae\�YakYlbbnYh]i fqYk]epi\ad\kYm]e\kp\gYd]Yhebfbdd\Yd[\Ybimf\i\addb]aY]hYd[\Ym[jgbefYakY\arb]ai\adfYm]d\edb]aYm]fbejYakYgg]ebd\kYm[jgbefYakY\arb]ai\adfYm]d\edb]aYe]ad]fgsYR�S) 1��V.5/}0�55,VV0�|4�32.v/4.36VXYZ[\Y]_abcdb]aYk\r\f]mgYakYo\\mgYep \adYfbgdgY]hYm\g]aa\fY�bd[Ypd[]bc\kYee\ggYd]Yhebfbdb\gYe]adbaba_Ybah]i db]aYgjgd\igYl\�e\mdYh]Yd[]g\Y\gY�bd[baYd[\Yhebfbdb\gY]hxYebffjYk\gb_ad\kYgYmp~fbefjYee\ggb~f\nYakYbggp\gYmm]mbd\Ypd[]bcdb]aYe\k\adbfgYl\s_sqY~k_\gqYbk\adbxYedb]aYe kgqYgi dYe kgnsY�\gb_ad\kY]hxYebfgY�bd[baYd[\Y]_abcdb]aY\rb\�YakYmm]r\Yd[\Yee\ggYfbgdYakYpd[]bcdb]aYe\k\adbfgY� ggb_ai\ad�Y]_abcdb]aSk\xYa\kYh\wp\aejqYdYf\gdYaapffj¡sYR�S¢ 1��V.5/}0�55,VV0£36423}XYZ[\Y]_abcdb]aYe]ad]fgYffYm[jgbefYee\ggYm]badgYlbaefpkba_Yk\gb_ad\kY\adjy\�bdYm]badgnYd]Yhebfbdb\gYe]adbaba_Ybah]i db]aYgjgd\igYl\�e\mdYh]Yd[]g\Y\gY�bd[baYd[\Yhebfbdb\gY]hxYebffjYk\gb_ad\kYgYmp~fbefjYee\ggb~f\nYakYr\bxY\gYbakbrbkpfYee\ggYpd[]bcdb]agY~\h]\Y_ adba_Yee\ggYd]Yd[\Yhebfbdb\gsYZ[\Y]_Sabcdb]aYfg]Ye]ad]fgYee\ggYd]Y\gY]hxYebffjYk\gb_ad\kYgYmp~fbefjYee\ggb~f\qYgYmm]mbd\qYbaYee]kae\Y�bd[Yd[\Y]_abcdb]a¤gYgg\ggi\adY]hYbgosYR�S¥ �55,VV0£36423}0¦320U2/6V�.VV.360+,-.|�XYZ[\Y]_abcdb]aYe]ad]fgYm[jgbefYee\ggYd]Ybah]i db]aYgjgd\iYdagibggb]aYfba\gYe^jba_Ypa\aejmd\kYbah]i db]aYd]Ym\r\adY\r\gk]mmba_qYbaSdagbdYi]kbxYedb]aqYkbgpmdb]aqY]Ym[jgbefYdim\ba_sYR�ST �55,VV0£36423}0¦320{.VW}/�0+,-.|�XYZ[\Y]_abcdb]aYe]ad]fgYm[jgbefYee\ggYd]Ybah]i db]aYgjgd\iYk\rbe\gYd[dYkbgmfjYbah]i db]aYd]Ym\r\adYpapd[]bc\kYbakbrbkpfgYh]iY]~g\rba_Yd[\YkbgmfjY]pdmpds

Page 24: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( ))*+,-./012.34512/-136789:;<=>?=@A?B@C;DE@FG@H=>?7DEHG<H;E@?I7BJ?KLMNOPNQRSTUVWX,-Y,6Z-0+/012[\] _E@;HED;@?789:;<=>?a<<G::bcdefcghijklmjnlgkcogklnghpcqerplsjtcjssfppcngclkughojnlgkcprpnfopcngcvfnfsncjkvchfpqgkvcngclkslvfknpwc[\]x y;:;HED?zE@HDE>bcdefcghijklmjnlgkcsgknhgtpcqerplsjtcjssfppcngclkughojnlgkcprpnfopc{rcj|nefknlsjnlkic}lplnghpc{fughfcj|neghlmlkicjssfppcngcujsltlnlfpcghcjhfjpcgnefhcnejkcjhfjpcvfplikjnfvcjpcq|{tlstrcjssfppl{tfwc[\]~ a<<G::?�E:bcdefcghijklmjnlgkcojlknjlkpcjc}lplnghcjssfppctgicngcujsltlnlfpc�f�sfqncughcnegpfcjhfjpc�lnelkcnefcujsltl]nlfpcgu�csljttrcvfplikjnfvcjpcq|{tlstrcjssfppl{tf�cnejnclkst|vfp�c�l�ckjofcjkvcghijklmjnlgkcgucnefcqfhpgkc}lplnlki�c�ll�cplikjn|hfcgucnefc}lplngh�c�lll�cughocguclvfknl�csjnlgk�c�l}�cvjnfcgucjssfpp�c�}�cnlofcgucfknhrcjkvcvfqjhn|hf�c�}l�cq|hqgpfcguc}lpln�cjkvc�}ll�ckjofcjkvcghijklmjnlgkcgucqfhpgkc}lplnfvwc�fplikjnfvcgu�csljtpc�lnelkcnefcghijklmjnlgkchf}lf�cnefcjssfppctgipc��pplikofkn�cghijklmjnlgk]vf�ckfvcuhf�|fksr�cjunfhcstgpfg|nwc[\]� 7E�GD?B��;�FG@H?=@A?7E�GD?z=�>;@ bcdefcghijklmjnlgkcqhgnfsnpcqg�fhcf�|lqofkncjkvcqg�fhcsj{tlkicughcnefclkughojnlgkcprpnfocuhgocvjojifcjkvcvfpnh|snlgkwc[\]�� BFGDG@<9?�8�HE��bcughcpqfsl�csctgsjnlgkpc�lnelkcjcujsltlnrcsgknjlklkicsgksfknhjnlgkpcguclkughojnlgkcprpnfochfpg|hsfpc�fwiw�cvjnjcsfknfhp�cpfh}fhchggop�cojlkuhjofchggop��cnefcghijklmjnlgkcqhg}lvfpcnefcsjqj{ltlnrcgucpe|nnlkicguucqg�fhcngcjkrclkughojnlgkcnfsekgtgircsgoqgkfkncnejncojrc{fcojtu|ksnlgklkic�fwiw�cv|fcngcjkcftfsnhlsjtc�chf�cghcnehfjnfkfvc�fwiw�cv|fcngcjc�jnfhctfj��c�lneg|ncfkvjkifhlkicqfhpgkkftc{rchf�|lhlkicnefocngcjqqhgjsecnefcf�|lqofknwc[\]�� BFGDG@<9?7E�GDbcdefcghijklmjnlgkcqhg}lvfpcjcpeghn]nfhoc|klknfhh|qnl{tfcqg�fhcp|qqtrcngcujsltlnjnfcjkcghvfhtrcpe|nvg�kcgucnefclkughojnlgkcprpnfoclkcnefcf}fkncgucjcqhlojhrcqg�fhcpg|hsfctgppwc[\]�) BFGDG@<9?�;8H;@ b?defcghijklmjnlgkcfoqtgrpcjkvcojlknjlkpcj|ngojnlscfofhifksrctlienlkicprpnfopcnejncjsnl]}jnfclkcnefcf}fkncgucjcqg�fhcg|njifcghcvlph|qnlgkcjkvcnejncsg}fhcfofhifksrcf�lnpcjkvcf}js|jnlgkchg|nfpwc[\]�� �;DG?7DEHG<H;E@bcdefcghijklmjnlgkcfoqtgrpcjkvcojlknjlkpc�chfcp|qqhfpplgkcjkvcvfnfsnlgkcvf}lsfp�prpnfopcnejncsjkc{fcjsnl}jnfvclkcnefcf}fkncgucjc�chfwc[\]�� �GF�GD=H�DG?=@A?��F;A;H9?zE@HDE>:bcdefcghijklmjnlgkchfi|tjhtrcojlknjlkpc�lnelkcjssfqnj{tfctf}ftpcjkvcogkl]nghpcnefcnfoqfhjn|hfcjkvce|olvlnrc�lnelkcujsltlnlfpcsgknjlklkiclkughojnlgkcprpnfopwc[\]�� �=HGD? =F=G?7DEHG<H;E@bcdefcghijklmjnlgkcqhgnfsnpcnefclkughojnlgkcprpnfocuhgoc�jnfhcvjojifchfp|tnlkicuhgoc{hg�fkcqt|o{lkictlkfpcghcgnefhcpg|hsfpcguc�jnfhctfj�jifc{rcfkp|hlkicnejncojpnfhcpe|nguuc}jt}fpcjhfcjssfppl{tf�c�gh�lkicqhgqfhtr�cjkvc�kg�kcngc�frcqfhpgkkftwc[\]�  G>;CGD9?=@A?¡GFEC=>bcdefcghijklmjnlgkcsgknhgtpclkughojnlgkcprpnfo]hftjnfvclnfopc�lwfw�cejhv�jhf�c�cho�jhf�cpgun�jhf�cfknfhlkicjkvcf�lnlkicnefcujsltlnrcjkvcojlknjlkpcjqqhgqhljnfchfsghvpcgucnegpfclnfopwc[\]�x a>HGD@=HG?�ED¢?�;HGbc£kvl}lv|jtpc�lnelkcnefcghijklmjnlgkcfoqtgrcjqqhgqhljnfclkughojnlgkcprpnfocpfs|hlnrcsgknhgtpcjncjtnfhkjnfc�gh�cplnfpwc

Page 25: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123/456230.24789:;<==9>?@9AB:CDE?F8@G+.H/31I/012375JK70L5M1N5-37K.-50O/0513P1Q1PK/4752RRK,S13H5,2710123752T5.-7,2371U1410S5V10O1352.H/31I/012375M13R4KP13H50O1.PW,/.0S57-.Q1R-5,.2Q1P-.7N5/.-50.K70V2.0OS5/3P5J--05-70/U417O-P57-RK.10S5R.10-.1/5T2.50O27-5,27101237X5M11N5-37K.-50O/052.H/31I/0123/4513T2.J/01235/3P513T2.J/012357S70-J75/.-5,.20-R0-P5PK.13H5/3P5/T0-.5,-.7233-45/R0123757KRO5/750-.J13/012375/3P50./37T-.7X5/3P5M111N5-J,42S5T2.J/457/3R012375T2.5,-.7233-45T/1413H5025R2J,4S5V10O52.H/31I/0123/457-RK.10S5,241R1-75/3P5,.2R-PK.-7YZKJU-.[-7R.1,0123\]_ 89:;<==9>?@9AB:CDE?8<>CAE?=a?8:<A9aB:9;bcdefcghijklmjnlgkcofpfqgrstcolssfulkjnfstcjkocrfhlgolvjqqwchfplfxsyzrojnfs{c|l}cjc~ghujqtcogvzufknfotcrfhsgkkfqcsfvzhlnwcrgqlvwcnejncjoohfssfscrzhrgsftcsvgrftchgqfstchfsrgksl�lqlnlfstcjkocvgurqljkvf�cjkoc|ll}c~ghujqtcogvzufknfocrhgvfozhfscngc~jvlqlnjnfcnefclurqfufknjnlgkcg~cnefcrfhsgkkfqcsfvzhlnwcrgqlvwcjkocjssgvljnfocrfhsgkkfqcsfvzhlnwcvgknhgqs�c\]) 8<;CDC<=?�D9�<:C�DC<=bcdefcghijklmjnlgkcjsslikscjchls�cofslikjnlgkcngcjqqcrgslnlgkscjkocfsnj�qlsefscsvhffklkicvhlnfhljc~ghclkolplozjqsc�cqqlkicnegsfcrgslnlgks�cdefcghijklmjnlgkchfplfxscjkochfplsfscrgslnlgkchls�cofslikjnlgksc��sslikufkn{cghijklmjnlgkof�ckfoc~hf�zfkvw��c\]* 89:;<==9>?@A:99=C=�bcdefcghijklmjnlgkcsvhffksclkolplozjqschf�zlhlkicjvvfsscngcghijklmjnlgkjqclk~ghujnlgkcjkoclk~ghujnlgkcswsnfusc�f~ghfcjzneghlmlkicjvvfss�c\]� 89:;<==9>?�9:�C=DC<=bc�efkcfurqgwufknclscnfhulkjnfotcnefcghijklmjnlgkcnfhulkjnfsclk~ghujnlgkcswsnfucjvvfsstcvgkozvnscf�lnclknfhplfxstcfkszhfscnefchfnzhkcg~cjqqcghijklmjnlgkjqclk~ghujnlgkcswsnfuhfqjnfocrhgrfhnwc|f�i�tc�fwstclofknl�cvjnlgkcvjhostc�zlqolkicrjssfs}tcjkocfkszhfscnejncjrrhgrhljnfcrfhsgkkfqcejpfcjvvfsscngcg~�cvljqchfvghoscvhfjnfoc�wcnefcnfhulkjnfocfurqgwffcnejncjhfcsnghfocgkcghijklmjnlgkjqclk~ghujnlgkcswsnfus�c\]� 89:;<==9>?�:=;�9:bcdefcghijklmjnlgkchfplfxsclk~ghujnlgkcswsnfusy~jvlqlnlfscjvvfsscjzneghlmjnlgkscxefkclkolplozjqscjhfchfjsslikfocghcnhjks~fhhfocngcgnefhcrgslnlgkscxlnelkcnefcghijklmjnlgkcjkoclklnljnfscjrrhgrhljnfcjvnlgksc|f�i�tchflsszlkic�fwstclofknl�cvjnlgkcvjhostc�zlqolkicrjssfs�cvqgslkicgqocjvvgzknscjkocfsnj�qlselkickfxcjvvgzkns�cjkocvejkilkicswsnfucjvvfsscjzneghlmjnlgks}�c\]� �AA9;;?��:99�9=D;b?defcghijklmjnlgkcvgurqfnfscjrrhgrhljnfcjvvfsscjihffufknsc|f�i�tckgkolsvqgszhfcjihffufknstcjvvfrnj�qfczsfcjihffufknstchzqfscg~c�fejplghtcvgk�clvng~lknfhfsncjihffufkns}c~ghclkolplozjqschf�zlhlkicjvvfsscngcghijklmjnlgkjqclk~ghujnlgkcjkoclk~ghujnlgkcswsnfusc�f~ghfcjzneghlmlkicjvvfss�c\]� ��C:a�8:DE?89:;<==9>?@9AB:CDEbcdefcghijklmjnlgkcfsnj�qlsefscrfhsgkkfqcsfvzhlnwchf�zlhfufknsc~ghcnelhorjhnwcrhgplofhsc|f�i�tcsfhplvfc�zhfjzstcvgknhjvnghstcjkocgnefhcghijklmjnlgkscrhgplolkiclk~ghujnlgkcswsnfucofpfqgrufkntclk~ghujnlgkcnfvekgqgiwcsfhplvfstcgznsgzhvfocjrrqlvjnlgkstckfnxgh�cjkocsfvzhlnwcujkjifufkn}cjkocugklnghscrhgplofhcvgurqljkvfcngcfkszhfcjof�zjnfcsfvzhlnw�c\]� 89:;<==9>?@=ADC<=;b?defcghijklmjnlgkcfurqgwscjc~ghujqcsjkvnlgkscrhgvfssc~ghcrfhsgkkfqc~jlqlkicngcvgurqwcxlnecfsnj�qlsefoclk~ghujnlgkcsfvzhlnwcrgqlvlfscjkocrhgvfozhfs�c

Page 26: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0123/456230.24789:;<=>?@A>B@CDE=?;FD@>B@;<GEF;9>H8BI+.J/31K/012375LM70N5O1P51Q-301RST5.-,2.0T5/3Q5U2..-U0513R2.L/01235/3Q513R2.L/012357S70-L5V5/W75135/501L-4S5L/33-.X5O11P5,.2Y1Q-5,.20-U01235R.2L5L/41U12M75U2Q-5/05/,,.2,.1/0-542U/012375W10Z1352.J/31K/0123/4513R2.L/012357S70-L7X5/3Q5O111P5L23102.513R2.L/012357S70-L57-UM.10S5/4-.075/3Q5/QY172.1-75/3Q50/[-5/,,.2,.1/0-5/U012375135.-7,237-\]ML -._-7U.1,0123abc 89:;<=>?@A>B@CDE=?;FD@>B@;<GEF;9>dDeFf9>?@A>dEDf<AgE<:hijklimnopqrsptrmqiulvlwmxyziuryyl{rqptlyzipquixlnrbmur|pww}inlvrl~y��xuptly�i�r�ipi�mn{pwzium|�{lqtluziy}ytl{ipquirq�mn{ptrmqirqtlonrt}ixmwr|}itkptipuunlyylyix�nxmylziy|mxlzinmwlyzinlyxmqyr�rwrtrlyzipqui|m{xwrpq|l�ipqui�rr�i�mn{pwzium|�{lqtluixnm|lu�nlyitmi�p|rwrtptlitklir{xwl{lqtpbtrmqim�itkliy}ytl{ipquirq�mn{ptrmqirqtlonrt}ixmwr|}ipquipyym|rptluiy}ytl{ipquirq�mn{ptrmqirqtlonrt}i|mqtnmwy�iab) �e?�>�<=<AF?;FD@hijklimnopqrsptrmqirulqtr�ilyzinlxmntyzipqui|mnnl|tyirq�mn{ptrmqiy}ytl{i�ip~y�iab� �?eFfFDg:>�DA<>dED;<f;FD@hijklirq�mn{ptrmqiy}ytl{ir{xwl{lqtyi{pwr|rm�yi|mulixnmtl|trmqitkptirq|w�ulyipi|pxpb�rwrt}i�mnip�tm{ptr|i�xuptly�iab* B@;Eg:FD@>�<;<f;FD@>�DDe:>?@A>�<f�@F�g<:hijklimnopqrsptrmqil{xwm}yitmmwyipquitl|kqr��lyitmi{mqrtmnilvlqtyimqitklirq�mn{ptrmqiy}ytl{ziultl|tipttp|�yzipquixnmvrulirulqtr�i|ptrmqim�i�qp�tkmnrslui�ylim�itkliy}ytl{�iab� 8<fgEF;9>�e<E;:>?@A>�A�F:DEF<:hijklimnopqrsptrmqinl|lrvlyirq�mn{ptrmqiy}ytl{iyl|�nrt}ipwlnty�puvrymnrlyimqipinlo�wpni�pyryziryy�lyipwlnty�puvrymnrlyitmipxxnmxnrptlixlnymqqlwzipquitp�lyipxxnmxnrptlip|trmqyirqinlyxmqyl�iab� 8<fgEF;9>�g@f;FD@?eF;9>�<EF�>f?;FD@hijklirq�mn{ptrmqiy}ytl{ivlnr�ilyitkli|mnnl|timxlnptrmqim�iyl|�nrt}i��q|trmqyi�lwl|trmqi�mqlimni{mnl��i�xmqiy}ytl{iytpnt�xipquinlytpntzi�xmqi|m{{pqui�}i�ylni~rtkipxxnmxnrptlixnrvrwlolzixlnrmur|pww}ilvln}i��yyroq{lqt�imnopqrsptrmqbul�iqluitr{lbxlnrmu��ipqui�lwl|trmqi�mqlimni{mnl��iqmtr�ilyiy}ytl{ipu{rqrytnptmnziyk�tyitkliy}ytl{ium~qzinlytpntyitkliy}ytl{�i~klqipqm{pwrlyipnliury|mvlnlu�iab� 8DC;�?E<>?@A>B@CDE=?;FD@>B@;<GEF;9hijklirq�mn{ptrmqiy}ytl{iultl|tyipquixnmtl|tyipoprqyti�qp�tkmnrslui|kpqolyitmiym�t~pnlipquirq�mn{ptrmq�iab  8¡?=>?@A>8¡9�?E<>dED;<f;FD@hijklirq�mn{ptrmqiy}ytl{ir{xwl{lqtyiyxp{ipquiyx}~pnlixnmtl|trmq�iab¢ B@CDE=?;FD@>B@¡g;>�<:;EFf;FD@:hijklimnopqrsptrmqinlytnr|tyitklirq�mn{ptrmqirqx�titmitklirq�mn{ptrmqiy}ytl{itmip�tkmnrsluixlnymqqlwimqw}�iabc£ B@CDE=?;FD@>B@¡g;>�ffgE?f9¤>�D=¡e<;<@<::¤>?@A>�?eFAF;9hijklirq�mn{ptrmqiy}ytl{i|kl|�yirq�mn{ptrmqirqx�tyi�mnip||�np|}zi|m{xwltlqlyyzipquivpwrurt}�iabcc ¥EEDE>¦?@AeF@Gh>jklirq�mn{ptrmqiy}ytl{irulqtr�ilyipquikpquwlyilnnmni|mqurtrmqyirqipqil§xlurtrm�yi{pqqln�iabc) B@CDE=?;FD@>g;¡g;>¦?@AeF@G>?@A>�<;<@;FD@hijklimnopqrsptrmqikpquwlyipquinltprqyim�tx�ti�nm{itklirq�mn{pbtrmqiy}ytl{irqip||mnupq|li~rtkimnopqrsptrmqpwixmwr|}ipquimxlnptrmqpwinl��rnl{lqty�i

Page 27: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0-12345/675289:;<=>;?@A;B=CDB@EF%!"$G%F#HI#F !J'G(I# '!F"%&$G #KF%!I&#(%!#F "F%JJ%&# L%FI!MF%JNF& %!#�FO;;:EEAPB=CDB@AQOPRS7T1/0U1605/83VW86X3Y0Z30[,/60\]37,_57631/[3-577,-630/\57V1605/31/[30/\57V1605/38]86,V331a830/31360V,2]3V1//,7b3Y00Z3_75c0[,3_756,-605/3\75V3V120-05W83-5[,31631__75_7016,325-1605/83a06.0/357T1/0U1605/1230/\57V1605/38]86,V8b31/[3Y000Z3V5/065730/\57V1605/38]86,V38,-W706]312,76831/[31[c08570,831/[361d,31__75_7016,31-605/830/37,8_5/8,efWVg,7h,8-70_605/ijkl O;;:EEAPB=CDB@AmB@>;nA?=oAmDB;:opD:Eqrsturvwxyz{|y}{vzr~u�u�v���r~{��u�{zy}u��ryz~r�uw{v~{�y���rwu�{u�����~y}u��r�{�ryr�vw�y��r~v���uz}u~�ry��u��r�vz}wv�r�v�{��r}ty}ry~~wu��u�r��w�v�u�r��v�u�rwv�u��rwu��vz�{�{�{}{u��ryz~r�v���{yz�u�ryz~r�{{�r�vw�y��r~v���uz}u~r�wv�u~�wu�r}vr�y�{�{}y}ur}tur{���u�uz}y}{vzrv�r}tury��u��r�vz}wv�r�v�{��ryz~ry��v�{y}u~ry��u��r�vz}wv���ijk) O;;Bp=CA�?=?�:�:=Cqrsturvwxyz{|y}{vzr�yzyxu�r{z�vw�y}{vzr���}u�ry��v�z}��r{z���~{zxru�}y��{�t{zx�ry�}{�y}{zx�r�v~{��{zx�rwu�{u�{zx�r~{�y��{zx�ryz~rwu�v�{zxry��v�z}��rsturvwxyz{|y}{vzrwu�{u��r{z�vw�y}{vzr���}u�ry��v�z}��ijk� O;;:EEA�=�BD;:�:=Cqrstur{z�vw�y}{vzr���}u�ruz�vw�u�ry��{xzu~ry�}tvw{|y}{vz�r�vwr�vz}wv��{zxry��u��r}vr}tur���}u�r{zry��vw~yz�ur�{}try���{�y��ur�v�{���ijk� �=�BD�?C>B=A�@B�A�=�BD;:�:=Cqrstur{z�vw�y}{vzr���}u�ruz�vw�u�ry��{xzu~ry�}tvw{|y}{vz�r�vwr�vz}wv��{zxr}tur�rv�rv�r{z�vw�y}{vzr�{}t{zr}tur���}u�ryz~r�u}�uuzr{z}uw�vzzu�}u~r���}u��r{zry��vw~yz�ur�{}try���{�y��ur�v�{���ijk* �:�?D?C>B=AB�A�pC>:Eqrstur{z�vw�y}{vzr���}u�ruz�vw�u�r�u�ywy}{vzrv�r~�}{u�r}twv�xtry��{xzu~ry��u��ry�}tvw{|y}{vz��ijk�  :?ECAmD>¡>@:�:qrstur{z�vw�y}{vzr���}u�ruz�vw�u�r}tur�v�}rwu�}w{�}{�ur�u}rv�rw{xt}���w{�{�uxu�rvwry��u��u�rzuu~u~r��r��uw�r�vwr�wv�u��u�ry�}{zxrvzr�uty��rv�r��uw��r�vwr}tur�uw�vw�yz�urv�r��u�{¢ru~r}y�£��ijk¤ ¥=Ep;;:EE�p@A B�>=AOCC:��CE¦PB=CDB@qrstur{z�vw�y}{vzr���}u�ruz�vw�u�ryr�{�{}rv�r§vwxyz{|y}{vzk~u¢rzu~rz���uwr�vz�u��}{�ur{z�y�{~ry��u��ry}}u��}�r��ryr��uwr~�w{zxryr§vwxyz{|y}{vzk~u¢rzu~r}{�ur�uw{v~r}{�ur�uw{v~�rstur{z�vw�y}{vzr���}u�ry�}v�y}{�y���r§©u�u�}{vz�r�v�£�r}tury��v�z}�zv~ur�vwryzr§vwxyz{|y}{vzk~u¢rzu~r}{�ur�uw{v~�r~u�y��rzuª}r�vx{zr�wv��}ry��vw~{zxr}vr§vwxyz{|y}{vzk~u¢rzu~r~u�y�ry�xvw{}t��r�tuzr}tur�yª{���rz���uwrv�r�z����u�����ry}}u��}�r{�ruª�uu~u~�ijk« �nEC:�A¥E:A¬BC>­A;?C>B=qrstur{z�vw�y}{vzr���}u�r~{���y��ryzry��wv�u~�r���}u�r��urzv}{¢r�y}{vzr�u��yxur�u�vwurxwyz}{zxr���}u�ry��u��r{z�vw�{zxr�v}uz}{y�r��uw��r�{�r}ty}r}tur��uwr{�ry��u��{zxryr®�©�rv�uwz�uz}r{z�vw�y}{vzr���}u��r�{{�r}ty}r���}u�r��yxur�y�r�ur�vz{}vwu~�rwu�vw~u~�ryz~r���°u�}r}vry�~{}�r�{{{�r}ty}r�zy�}tvw{|u~r��urv�r}tur���}u�r{�r�wvt{�{}u~ryz~r���°u�}r}vr�w{�{zy�ryz~r�{�{�r�uzy�}{u��ryz~r�{��r}ty}r��urv�r}tur���}u�r{z~{�y}u�r�vz�uz}r}vr�vz{}vw{zxryz~rwu�vw~{zx�rstur���}u�r��urzv}{¢r�y}{vzr�u��yxur�wv�{~u�ry��wv�w{y}ur�w{�y��ryz~r�u��w{}�rzv}{�u�r��y�u~rvzry��v�{y}u~r�w{�y��ryz~r�u��w{}�r�v�{�{u�rvwr����yw{u��ryz~rwu�y{z�rvzr}tur��wuuzr�z}{�r}tur��uwr}y£u�ruª��{�{}ry�}{vz�r}vr�vxrvzr}vr}tur{z�vw�y}{vzr���}u��ijk± mD:¡>BpEA B�B=A¬BC>­A;?C>B=qrstur{z�vw�y}{vzr���}u�rzv}{¢ru�r}tur��uw�r��vzr����u�����r�vxvz�rv�r}tur~y}uryz~r}{�urv�r}tur�y�}r�vxvz�ryz~r}turz���uwrv�r�z����u�����r�vxvzry}}u��}�r�{z�ur}tur�y�}r����u�����r�vxvz�

Page 28: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0-12345/675289::;<<=>?@AB?C=D9>E=FGHIJKILMNOPQRS,7T,8-70U605/VWXYZ >?@:[BB;@A=\;<<]?@=>?@AB?C_ab_cdefghijcfd_klkjbh_mchcjk_jab_dnhobg_fe_pfdpnggbdj_kbkkcfdk_efg_idl_nkbg_jf_qfgridcsijcfdXtbu_dbt_dnhobg_fe_kbkkcfdkvwVWXYY \;<<]?@=x?:y_ab_cdefghijcfd_klkjbh_zgb{bdjk_engjabg_ippbkk_jf_jab_klkjbh_ol_cdcjcijcdr_i_kbkkcfd_mfp|_jaij_gbhicdk_cd_beebpj_ndjcm_jab_nkbg_gbbkjiomckabk_ippbkk_nkcdr_izzgfzgcijb_ctbdjcu_pijcfd_idt_injabdjcpijcfd_zgfpbtngbkwVWXY) \;<<]?@=};B~]@�A]?@_ab_cdefghijcfd_klkjbh_injfhijcpimml_jbghcdijbk_i_kbkkcfd_iejbg_qfgridcsijcfdXtbu_dbt_jchb_zbgcftv_fe_cdipjc{cjlwVWXY� \[�;B�]<]?@=�@�=�;�];� _ab_fgridcsijcfd_knzbg{ckbk_idt_gb{cb�k_jab_ipjc{cjcbk_fe_nkbgk_�cja_gbkzbpj_jf_jab_bdefgpbhbdj_idt_nkirb_fe_cdefghijcfd_klkjbh_ippbkk_pfdjgfmkwVWXY� �;B~]AA;�=9:A]?@<=�]A�?[A=��;@A]�=:�A]?@=?B=9[A�;@A]:�A]?@_ab_fgridcsijcfd_ctbdjcu_bk_idt_tfpnhbdjk_kzbpcu_p_nkbg_ipjcfdk_jaij_pid_ob_zbgefghbt_fd_jab_cdefghijcfd_klkjbh_�cjafnj_ctbdjcu_pijcfd_fg_injabdjcpijcfdwVWXY� 9[A?~�A;�=��By]@�_ab_cdefghijcfd_klkjbh_hig|k_fnjznj_nkcdr_kjidtigt_dihcdr_pfd{bdjcfdk_jf_ctbdjcel_idl_kzbpcim_tckkbhcdijcfd�_aidtmcdr�_fg_tckjgconjcfd_cdkjgnpjcfdkwVWXY* 9[A?~�A;�=x��;C]@��>?@AB?C_ab_cdefghijcfd_klkjbh_izzgfzgcijbml_miobmk_cdefghijcfd_cd_kjfgirb�_cd_zgfpbkk�_idt_cd_jgidkhckkcfdwVWXY� �;~?A;=9::;<<_ab_fgridcsijcfd_tfpnhbdjk�_hfdcjfgk�_idt_pfdjgfmk_imm_hbjaftk_fe_gbhfjb_ippbkk_�bwrw�_tcimXnz�_ogfitoidt�_�djbgdbj�_jf_jab_cdefghijcfd_klkjbhw_Vzzgfzgcijb_fgridcsijcfd_feu_pcimk_injafgcsb_bipa_gbhfjb_ippbkk_hbjaft_efg_jab_cdefghijcfd_klkjbh_idt_injafgcsb_fdml_jab_dbpbkkigl_nkbgk_efg_bipa_ippbkk_hbjaftwVWXY� �]B;C;<<=9::;<<=�;<AB]:A]?@<_ab_fgridcsijcfd�_�c�_bkjiomckabk_nkirb_gbkjgcpjcfdk_idt_chzmbhbdjijcfd_rnctidpb_efg_�cgbmbkk_jbpadfmfrcbk�_idt_�cc�_tfpnhbdjk�_hfdcjfgk�_idt_pfdjgfmk_�cgbmbkk_ippbkk_jf_jab_cdefghijcfd_klkjbhw_Vzzgfzgcijb_fgridcsijcfdim_feu_pcimk_injafgcsb_jab_nkb_fe_�cgbmbkk_jbpadfmfrcbkw_VWXY� 9::;<<=>?@AB?C=�?B=�?BA��C;=9@�=�?�]C;=�;�]:;<_ab_fgridcsijcfd�_�c�_bkjiomckabk_nkirb_gbkjgcpjcfdk_idt_chzmbXhbdjijcfd_rnctidpb_efg_zfgjiomb_idt_hfocmb_tb{cpbk�_idt_�cc�_tfpnhbdjk�_hfdcjfgk�_idt_pfdjgfmk_tb{cpb_ippbkk_jf_fgridcsijcfdim_dbj�fg|kw_Vzzgfzgcijb_fgridcsijcfdim_feu_pcimk_injafgcsb_jab_nkb_fe_zfgjiomb_idt_hfocmb_tb{cpbkw_VWX)Z �;B<?@�CC�=��@;�=�@�?B~�A]?@=\�<A;~<_ab_fgridcsijcfd_gbkjgcpjk_jab_nkb_fe_zbgkfdimml_f�dbt_cdefghijcfd_klkjbhk_efg_feu_pcim_ w¡w_¢f{bgdhbdj_onkcdbkk_cd{fm{cdr_jab_zgfpbkkcdr�_kjfgirb�_fg_jgidkhckkcfd_fe_ebtbgim_cdefghijcfd

Page 29: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0-12345/675289:;<=>?@;>9AAB:@=?C<D<=E>F9GHI7J1/0K1605/83LM86N3O0P3-7,16,Q3R756,-6Q31/S37,610/30/T57L1605/38U86,L31MS0637,-57S836536.,3,V6,/63/,,S,S3653,/1W2,36.,3L5/06570/JQ31/12U808Q30/X,860J1605/Q31/S37,R5760/J35T3M/21YTM2Q3M/1M6.570K,SQ35730/1RR75R7016,30/T57L1605/38U8Z6,L31-60X06U[31/S3O00P3,/8M7,36.1636.,31-605/835T30/S0X0SM1230/T57L1605/38U86,L3M8,783-1/3W,3M/0\M,2U3671-,S36536.58,3M8,7838536.,U3-1/3W,3.,2S31--5M/61W2,3T5736.,0731-605/8]3MLW,7_,8-70R605/abc 9:;<=>?@;>9AAB:@=?C<D<=E>dBD<AE>?@;>deBAf;:efghijklimnopqrsptrmqiulvlwmxyziuryyl{rqptlyzipquixlnrmur|pww}inlvrl~y��xuptly�i�r�ipi�mn{pwzium|�{lqtluzip�urtipquip||m�qtp�rwrt}ixmwr|}itkptipuunlyylyix�nxmylziy|mxlzinmwlyzinlyxmqyr�rwrtrlyzipqui|m{xwrpq|l�ipqui�rr�i�mn{pwzium|�{lqtluixnm|lu�nlyitmi�p|rwrtptlitklir{xwl{lqtptrmqim�itklip�urtipquip||m�qtp�rwrt}ixmwr|}ipquipyym|rptluip�urtipquip||m�qtp�rwrt}i|mqtnmwy�ab) 9:;<=?CDf>��f@=ghijklirq�mn{ptrmqiy}ytl{iolqlnptlyip�urtinl|mnuyi�mnitkli�mwwm~rqoilvlqty�i�yyroq{lqt�imnopqrbsptrmqbul�iqluip�urtp�wlilvlqty��i�b� �B@=f@=>B�>9:;<=>�fABe;ghijklirq�mn{ptrmqiy}ytl{i|pxt�nlyiy���i|rlqtirq�mn{ptrmqirqip�urtinl|mnuyitmilytp�wryki~kptilvlqtyim||�nnluzitkliym�n|lyim�itklilvlqtyzipquitklim�t|m{lyim�itklilvlqty�ab� 9:;<=>�=Be?�f>�?�?A<=Ehijklimnopqrsptrmqipwwm|ptlyiy���i|rlqtip�urtinl|mnuiytmnpoli|pxp|rt}ipqui|mq�io�nlyip�urtbrqoitmixnlvlqtiy�|ki|pxp|rt}i�lrqoil�|llulu�ab� 9:;<=>deBAfgg<@�hi�qitklilvlqtim�ipqip�urti�prw�nlimnip�urtiytmnpoli|pxp|rt}i�lrqoinlp|kluzitklirq�mn{ptrmqiy}ytl{ipwlntyipxxnmxnrptlimnopqrsptrmqpwim��i|rpwyipquitp�lyitkli�mwwm~rqoipuurtrmqpwip|trmqy�i�mnopqrsptrmqbul�iqluip|trmqyitmi�litp�lqi�l�o�ziyk�tium~qirq�mn{ptrmqiy}ytl{zimvln~nrtlimwulytip�urtinl|mnuyziytmxiolqlnptrqoip�urtinl|mnuy���ab� 9:;<=>�B@<=Be<@��>9@?DEg<g�>?@;>�f�Be=<@�hijklimnopqrsptrmqinlo�wpnw}inlvrl~y�pqpw}slyip�urtinl|mnuyi�mnirqurb|ptrmqyim�irqpxxnmxnrptlimni�q�y�pwip|trvrt}zirqvlytroptlyiy�yxr|rm�yip|trvrt}imniy�yxl|tluivrmwptrmqyzinlxmntyi�iqurqoyitmipxxnmxnrptlim��i|rpwyzipquitp�lyiql|lyypn}ip|trmqy�ab* 9:;<=>�f;:A=<B@>?@;>�f�Be=>�f@fe?=<B@hijklirq�mn{ptrmqiy}ytl{ixnmvrulyipqip�urtinlu�|trmqipquinlxmntiolqlnptrmqi|pxp�rwrt}�iab� �< f>�=? �ghijklirq�mn{ptrmqiy}ytl{ixnmvrulyitr{liytp{xyi�mni�ylirqip�urtinl|mnuiolqlnptrmq�iab¡ deB=fA=<B@>B�>9:;<=>¢@�Be ?=<B@hijklirq�mn{ptrmqiy}ytl{ixnmtl|tyip�urtirq�mn{ptrmqipquip�urtitmmwyi�nm{i�qp�tkmnrsluip||lyyzi{mur�i|ptrmqzipquiulwltrmq�iabc£ ¤B@¥ef�:;<?=<B@hijklirq�mn{ptrmqiy}ytl{ixnmvrulyitkli|pxp�rwrt}itmiultln{rqli~kltklnipiorvlqirqurvru�pwitmm�ipixpntr|�wpnip|trmqi�l�o�zi|nlptluirq�mn{ptrmqziylqtipi{lyypolzipxxnmvluirq�mn{ptrmqi�l�o�zitmirqur|ptli|mq|�nnlq|limniyroqipi|mqtnp|t�imninl|lrvluipi{lyypol��iabcc 9:;<=>�f=f@=<B@hijklimnopqrsptrmqinltprqyip�urtiwmoyi�mni�yyroq{lqt�imnopqrsptrmqbul�iqluitr{lixlnrmu�itmixnmvruliy�xxmnti�mnip�tlnbtklb�p|tirqvlytroptrmqyim�iyl|�nrt}irq|rulqtyipquitmi{lltinlo�wptmn}ipquimnopqrsptrmqpwirq�mn{ptrmqinltlqtrmqinl¦�rnl{lqty�i

Page 30: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0-12345/675289:;<=>?@AB=>C<@B<:@DE=F;<=>AB=>C<@G9DHI7J1/0K1605/83LM8630N,/60OP30/O57L1605/38P86,L3M8,78Q3R75-,88,831-60/J35/3S,.12O35O3M8,78Q3573N,T0-,831/N31M6.,/60U-16,3V573T,70OPW36.,30N,/6060,835O36.58,3M8,78Q3R75-,88,8Q3573N,T0-,8Q318313R7,7,XM0806,36531225Y0/J31--,88365357J1/0K1U605/1230/O57L1605/38P86,L8Z3[MLS,7\,8-70R605/]_ 9:;<=>?@AB=>C<@B<:@DE=F;<=>AB=>C<@aCb>Ac@B<:@adCA;:Ed;efghijgklmnopqnrpkogsjtjukvwxgspwwjyponrjwxgnosgvjlp_kspznuu{gljtpj|w}~vsnrjw�g�p�gng�klynuxgskz~yjorjsxgpsjorp�gznrpkognosgn~rijorpznrpkogvkupz{grinrgnssljwwjwgv~lvkwjxgwzkvjxglkujwxgljwvkowp�puprpjwxgnosgzkyvupnozj�gnosg�pp�g�klynuxgskz~yjorjsgvlkzjs~ljwgrkg�nzpuprnrjgrijgpyvujyjorn_rpkogk�grijgpsjorp�gznrpkognosgn~rijorpznrpkogvkupz{gnosgnwwkzpnrjsgpsjorp�gznrpkognosgn~rijorpznrpkogzkorlkuw�g]_) DE:>=B�b;@��;<=efghijgpo�klynrpkogw{wrjygmjojlnrjwgn~sprgljzklswg�klgrijg�kuuk|pomgjtjorw�g�wwpmoyjor�gklmnop_qnrpko_sj�gojsgn~sprn�ujgjtjorw��g]_� �;�>A;@9:;<=>?@AB=>C<@B<:@DE=F;<=>AB=>C<fghijgpo�klynrpkogw{wrjygpsjorp�gjwgnosgn~rijorpznrjwgwvjzp�gzgsjtpzjwg�j�kljgjwrn�upwipomgngzkoojzrpko�g]_� 9:;<=>?@;d@�B<B�;�;<=fghijgklmnopqnrpkogynonmjwg~wjlgpsjorp�gjlwg�{�g�p�g~op�~ju{gpsjorp�{pomgjnzig~wjl�g�pp�gtjlp�{pomgrijgpsjorpr{gk�gjnzig~wjl�g�ppp�gljzjptpomgn~riklpqnrpkogrkgpww~jgng~wjlgpsjorp�gjlg�lkygnognvvlkvlpnrjgklmnop_qnrpkogk��gzpnu�g�pt�gjow~lpomgrinrgrijg~wjlgpsjorp�gjlgpwgpww~jsgrkgrijgporjosjsgvnlr{�g�t�gspwn�upomg~wjlgpsjorp�gjlgn�rjlg�wwpmoyjor�gklmnopqnrpko_sj�gojsgrpyjgvjlpks�gk�gponzrptpr{�gnosg�tp�gnlziptpomg~wjlgpsjorp�gjlw�g]_� 9:;<=>?@;d@�B<B�;�;<=fghijgklmnopqnrpkogynonmjwg~wjlgpsjorp�gjlwg�{�g�p�g~op�~ju{gpsjorp�{pomgjnzig~wjl�g�pp�gtjlp�{pomgrijgpsjorpr{gk�gjnzig~wjl�g�ppp�gljzjptpomgn~riklpqnrpkogrkgpww~jgng~wjlgpsjorp�gjlg�lkygnognvvlkvlpnrjgklmnop_qnrpkogk��gzpnu�g�pt�gjow~lpomgrinrgrijg~wjlgpsjorp�gjlgpwgpww~jsgrkgrijgporjosjsgvnlr{�g�t�gspwn�upomg~wjlgpsjorp�gjlgn�rjlg�wwpmoyjor�gklmnopqnrpko_sj�gojsgrpyjgvjlpks�gk�gponzrptpr{�gnosg�tp�gnlziptpomg~wjlgpsjorp�gjlw�g]_� DE=F;<=>AB=Cd@�;;:�BA�fghijgpo�klynrpkogw{wrjygvlktpsjwg�jjs�nz�grkgng~wjlgs~lpomgnognrrjyvrjsgn~rijorpzn_rpkognosgrinrg�jjs�nz�gskjwgokrgzkyvlkypwjgrijgn~rijorpznrpkogyjzinopwy�g]_� �dc�=C�dB�F>A@�C:Eb;@DE=F;<=>AB=>C<fg�klgn~rijorpznrpkogrkgngzl{vrkmlnvipzgyks~ujxgrijgpo�klynrpkogw{wrjygjyvuk{wgn~rijorpznrpkogyjrikswgrinrgyjjrgrijglj�~pljyjorwgk�g�]��g��_)�g�ce=;�@B<:@�C��E<>AB=>C<e@adC=;A=>C<@G��HI7J1/0K1605/83LM86 3V0W3L5/0657Q3-5/6752Q31/N3R756,-6357J1/0K1605/123-5LLM/0-1605/83V0Z,ZQ30/O57L1605/3671/8L066,N35737,-,0T,N3SP357J1/0K1605/1230/O57L1605/38P86,L8W31636.,3,¡6,7/123S5M/N170,831/N3¢,P30/6,7/123S5M/N170,835O36.,30/O57L1605/38P86,L8£31/N3V00W3,LR25P317-.06,-6M7123N,80J/8Q385O6Y17,3N,T,25RL,/636,-./0XM,8Q31/N38P86,L83,/J0/,,7U0/J3R70/-0R2,836.163R75L56,3,OO,-60T,30/O57L1605/38,-M706P3Y06.0/357J1/0K1605/1230/O57L1605/38P86,L8Z[MLS,7\,8-70R605/�¤_ �ce=;�@B<:@�C��E<>AB=>C<e@adC=;A=>C<@aCb>Ac@B<:@adCA;:Ed;efghijgklmnopqnrpkogsjtjukvwxgspwwjyponrjwxgnosgvjlp_kspznuu{gljtpj|w}~vsnrjw�g�p�gng�klynuxgskz~yjorjsxgw{wrjygnosgzkyy~opznrpkowgvlkrjzrpkogvkupz{grinrgnssljwwjwgv~lvkwjxgwzkvjxglkujwxgljwvkowp�puprpjwxgnosgzkyvupnozj�gnosg�pp�g�klynuxgskz~yjorjsgvlkzjs~ljwgrkg�nzpuprnrjgrijgpyvujyjornrpkogk�grijgw{wrjygnosgzkyy~opznrpkowgvlkrjzrpkogvkupz{gnosgnwwkzpnrjsgw{wrjygnosgzkyy~opznrpkowgvlkrjzrpkogzkorlkuw�g�¤_) D��b>AB=>C<@aBd=>=>C<><�fghijgpo�klynrpkogw{wrjygwjvnlnrjwg~wjlg�~ozrpkonupr{g�pozu~spomg~wjlgporjl�nzjgwjltpzjw�g�lkygpo�klynrpkogw{wrjygynonmjyjorg�~ozrpkonupr{�g

Page 31: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0-12345/675289:;<=>?@AB?CD>>EAFG@<FDA;?HID<=G<FDA?J9CK?LMNOPQORSTUVWXY,7Z,8-70[605/\]_ 9=GEIF<:?EAG<FDA?a;Db@<FDAcdefgdhijklmnohkidpqpogmdhpkrnogpdpgstlhoqdjtisohkipdjlkmdikipgstlhoqdjtisohkipud\]v aAwDI>@<FDA?x=>A@A<;cdefgdhijklmnohkidpqpogmdylgzgiopdtintofklh{g|dni|dtihiogi|g|dhijklmnohkidolnipjgldzhndpfnlg|dpqpogmdlgpktlsgpud\]} ~=AF@b?Dw?9=I�FG=?HID<=G<FDAcdefgdhijklmnohkidpqpogmdylkogsopdn�nhipodkldrhmhopdofgdgjjgsopdkjdofgdjkrrk�hi�doqygpdkjd|gihnrdkjdpglzhsgdnoons�p�d��pph�imgio�dkl�nih{nohki|g�dig|drhpodkjdoqygpdkjd|gihnrdkjdpglzhsgdnoons�pdkldlgjglgisgdokdpktlsgdjkldstllgiodrhpo�ud\]� x=;DEIG=?HIFDIF<:c?efgdhijklmnohkidpqpogmdrhmhopdofgdtpgdkjdlgpktlsgpd�qdylhklhoqud\]� �DEAB@I:?HID<=G<FDAcdefgdhijklmnohkidpqpogmdmkihoklpdni|dskiolkrpdskmmtihsnohkipdnodofgdg�oglinrd�kti|nlqdkjdofgdhijklmnohkidpqpogmdni|dnod�gqdhioglinrd�kti|nlhgpd�hofhidofgdpqpogmud\]� �I@A;>F;;FDA?aA<=�IF<:cdefgdhijklmnohkidpqpogmdylkogsopdofgdhiog�lhoqdkjdolnipmhoog|dhijklmnohkiud\]* �I@A;>F;;FDA?CDA�?B=A<F@bF<:cdefgdhijklmnohkidpqpogmdylkogsopdofgdski�d|giohnrhoqdkjdolnipmhoog|dhijklmnohkiud\]�� �=<�DI�?~F;GDAA=G<cdefgdhijklmnohkidpqpogmdoglmhinogpdndigo�kl�dskiigsohkidnodofgdgi|dkjdndpgpphkidkldnjogld��pph�imgio�dkl�nih{nohki|g�dig|dohmgdyglhk|�dkjdhinsohzhoqud\]�� �IE;<=B?H@<�cdefgdhijklmnohkidpqpogmdgpon�rhpfgpdndoltpog|dskmmtihsnohkipdynofd�go�ggidofgdtpgldni|dofgdpgstlhoqdjtisohkinrhoqdkjdofgdpqpogmud\]�) CI:�<D�I@��FG?�=:?�;<@�bF;�>=A<?@AB?�@A@�=>=A<cdefgdhijklmnohkidpqpogmdgmyrkqpdntokmnog|dmgsfnihpmpd�hofdptyyklohi�dylksg|tlgpdkldmnitnrdylksg|tlgpdjkldslqyok�lnyfhsd�gqdgpon�rhpfmgiodni|d�gqdmnin�gmgioud\]�_ �;=?Dw?�@bFB@<=B?CI:�<D�I@��:cd�fgidslqyok�lnyfqdhpdgmyrkqg|d�hofhidofgdhijklmnohkidpqpogm�dofgdpqpogmdygljklmpdnrrdslqyok�lnyfhsdkyglnohkipd hisrt|hi�d�gqd�giglnohki¡dtphi�d¢£¤\d�v�)d\]�v HE�bFG?¥GG=;;?HID<=G<FDA;cdjkldyt�rhsrqdnznhrn�rgdpqpogmp�dofgdhijklmnohkidpqpogmdylkogsopdofgdhiog�lhoqdkjdofgdhijklmnohkidni|dnyyrhsnohkipud\]�} CDbb@�DI@<F�=?CD>�E<FA�cdefgdhijklmnohkidpqpogmdylkfh�hopdlgmkogdnsohznohkidkjdskrrn�klnohzgdskmytohi�dmgsfnihpmpd gu�u�dzh|gkdni|dnt|hkdskijglgishi�¡dni|dylkzh|gpdnidg�yrhshodhi|hsnohkidkjdtpgdokdofgdrksnrdtpglpd gu�u�dtpgdkjdsnmglndkldmhslkyfkig¡ud\]�� �I@A;>F;;FDA?Dw?9=GEIF<:?H@I@>=<=I;cdefgdhijklmnohkidpqpogmdlgrhn�rqdnppkshnogpdpgstlhoqdynlnmgoglpd gu�u�dpgstlhoqdrn�grpdni|dmnl�hi�p¡d�hofdhijklmnohkidg�sfni�g|d�go�ggidhijklmnohkidpqpogmpud\]�� HE�bFG?�=:?aAwI@;<IEG<EI=?C=I<F�?G@<=;cdefgdkl�nih{nohkid|gzgrkypdni|dhmyrgmgiopdndsgloh�dsnogdykrhsqdni|dsgloh�dsnohkidylnsohsgdponogmgiodjkldofgdhpptnisgdkjdyt�rhsd�gqdsgloh�dsnogpdtpg|dhidofgdhijklmnohkidpqpogmud\]�� �D�Fb=?CDB=cdefgdkl�nih{nohki�d h¡dgpon�rhpfgpdtpn�gdlgpolhsohkipdni|dhmyrgmgionohkid�th|nisgdjkldmk�hrgdsk|gdogsfikrk�hgpd�npg|dkidofgdykogiohnrdokdsntpgd|nmn�gdokdofgdhijklmnohkidpqpogmdhjdtpg|dmnrhshktprq¦dni|d hh¡d|kstmgiop�dmkihoklp�dni|dskiolkrpdofgdtpgdkjdmk�hrgdsk|gd�hofhidofgdhijklmnohkidpqpogmud�yylkylhnogdkl�nih{nohkinrdkj�dshnrpdntofklh{gdofgdtpgdkjdmk�hrgdsk|gud\]�* �DFG=?§�=I?aA<=IA=<?HID<DGDbc?efgdkl�nih{nohki�d h¡dgpon�rhpfgpdtpn�gdlgpolhsohkipdni|dhmyrgmgionohkid�th|nisgdjkldkhsgd©zgld£iogligod¤lkokskrd ©£¤¡dogsfikrk�hgpd�npg|dkidofgdykogiohnrdokdsntpgd|nmn�gdokdofgdhijklmnohkidpqpogmdhjdtpg|dmnrhshktprq¦dni|d hh¡d|kstmgiop�dmkihoklp�dni|dskiolkrpdofgdtpgdkjd©£¤d�hofhidofgdhijklmnohkidpqpogmud�yylkylhnogdkl�nih{nohkinrdkj�dshnrpdntofklh{gdofgdtpgdkjd©£¤ud

Page 32: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+$, #-.%/'0# !1-2$0 !1-#3%-0%/'0# !1-/34"%5-(4!41%(%!#-4!,-#3%-6'40,-'7-, 0%&#'0"-0%&% 8%-7'0(49-7%%,64&:-70'(-#3%-4$, #-#%4(�-�3 "-:!'�9%,1%-#04!"7%0-"3'$9,-6%-4!-'/%!-4!,-#04!"/40%!#-/0'&%""�-+9('"#-%8%0;-4$, #- ,%!# <-%"-'//'0#$! # %"-7'0- (/0'8%=(%!#�-�3%-/0 (40;-1'49-'7-(4!41%(%!#-4!,-4$, #'0"-"3'$9,-6%-#'-4,,0%""-&0 # &49- ""$%"-<-0"#5-7'99'�%,-6;- (/'0=#4!#- ""$%"�->'#3-(4!41%(%!#-4!,-4$, #'0"-"3'$9,-�'0:-#'-%!"$0%-#34#5-�34#%8%0-4&# '!-/94!"-#3%;-410%%-#'5-#3%-1'49"-40%-4&3 %8469%-4!,-6%!%<-& 49-#'-#3%-'014! ?4# '!�2$0 !1-#3%-0%/'0# !1-/34"%5-(4!41%(%!#-($"#-,%#%0( !%-�3 &3-&'00%&# 8%-4&# '!"- #-� 99- (/9%(%!#-4!,-�3%!5-64"%,-'!-4$, #-<-!, !1"�-@4!1%0"-� 99-/0'8 ,%-'8%0" 13#-4!,-"$//'0#-#'-%!"$0%-#3%-# (%9;-0%"'9$# '!-'7-7'$!,- ""$%"�-+9#3'$13-#3%-4$, #-#%4(-(4;-(4:%-0%&'((%!,4=# '!"-64"%,-'!- #"-4""%""(%!#"-'7-0 ":"-4!,-&'!"%A$%!&%"5- #-&4!!'#-(4:%-'0-, &#4#%-(4!41%0 49-,%& " '!"��3%-7'99'� !1-40%-#;/ &49-"#%/"-4!-4$, #-#%4(-#4:%"-#'-&'!<-0(-4!,-0%9%4"%-#3%-4$, #-0%"$9#"�B CDEFGHIJKCFLMJGLNCOPQPRLOLQHSCNIJOPTTUCFGKVEKKGQRCKGRQGWCVPQHCPEFGHCWCQFGQRKCPQFCVIQVTEKGIQKCMLNIJLCHXLUCGKKELCHXLCWCQPTCPEFGHCJLYIJHCCZPQPRLJKCJLVLG[LCPC\JGHHLQCFJPNHCJLYIJHCNJIOCPEFGHIJK]]C XLCJLYIJHCVIOOEQGVPHLKCPEFGHCJLKETHKCVTLPJTUCPQFCYJLVGKLTU]]C_LKETHKCPJLCYJLKLQHLFCGQCPQCEQMGPKLFCHIQLSCQIHGQRC\XLJLCOPQPRLOLQHCXPKCHPLQCPVHGIQKCHICVIJJLVHCFLWCVGLQVGLKCPQFCPVQI\TLFRGQRCRIIFCYLJNIJOPQVLCCZPQPRLOLQHCPQFCPEFGHIJKCFGKVEKKCHXLCFJPNHCJLYIJHCCZPQPRLOLQHCYJI[GFLKCNLLFMPVCIQCHXLCFJPNHCJLYIJHCCDEFGHIJKCJL[GL\COPQPRLJGPTCVIOOLQHKCPQFCPVHGIQCYTPQaKbCCDEFGHIJKCWCQPTGcLCPQFCFGKHJGMEHLCHXLCWCQPTCPEFGHCJLYIJHCCDEFGHIJKCVTIKLCIEHCHXLCGQHLJQPTCPEFGHCYJIdLVHCPQFCYTPQCPQUCQLVLKKPJUCNITTI\eEYCLNNIJHKCJLRPJFGQRCOPQPRLOLQHfKCPVHGIQCYTPQKC+$, #'0"-( 13#-49"'-&3''"%-#'-&'(($! &4#%-"'(%-4$, #-<-!, !1"-#34#-( 13#-6%-$"%7$9-7'0- !7'0(4# '!-"%&$0 #;-%7<-& %!&;-4!,-%77%&# 8%!%""5-6$#-,'-!'#-�4004!#- !&9$" '!- !-#3%-7'0(49-0%/'0#�-�3 "-#;/%-'7-&'(($! &4# '!-"3'$9,-6%-,'&$(%!#%,5- 7-'!9;-4"-4-!'#%- !-4$, #-<-!, !1"-#34#-#3%-#'/ &-�4"-8%06499;-, "&$""%,�B-ghijklmhnompnjhqirnpsitqpmuvnqstwinhptkhmvimxwnpiyxhzpnjhq{ipstkti|m}iutiqpmhwmkwij~tkmpnhli~kjztwxktqi�����iyjkimxwnpikt~jkpnhli�mhwijpstkimxwnpimzpn�npntq��igyiqj{ipstqtimxwnpi���qiqsjxvwiutikt�ntrtwimhwixhwtkqpjjwiu}i|mhmlt|thp�

Page 33: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./,012345,3/1367809:;�%<<=(>!>?%@;A$" !%"";$! #;'B; !C'B(># '!;"%&$B #D;EB'?B>(; !&<$@%";B'A$"#;E<>!"F;EB'&%@$B%"F;?'><"F;'AG%&=# H%"F;#B> !%@;"#>CCF;E%BC'B(>!&%;B%E'B# !?F;>!@;'!?' !?; (EB'H%(%!#;%CC'B#"�;�I%; !#%B!><;>$@ #;#%>(;<''J";C'B;%H @%!&%;#I>#;#I%;A$" !%"";$! #;>!@; !C'B(># '!;"%&$B #D;EB'?B>(;>B%;�%<<;'B?>! K%@;>!@;�%<<;(>!>?%@�;�I%;"%&$=B #D;EB'?B>(;($"#;><"';"E%& L;&><<D;>!@;#B>&%>A<D;( # ?>#%;B "J";B%<>#%@;#';J%D;A$" !%"";'AG%&# H%"�;M>!>?%B ><;EB%E>=B># '!;"I'$<@;(> !<D;A%;B'$# !%F;@>D=#'=@>D;EB>&# &%"�M>!>?%(%!#N";$<# (>#%;?'><; !;#I%;>$@ #;EB'&%""; ";!'#;#';(>J%;#I%;>$@ #'B";I>EEDF;A$#;B>#I%B;#';@%('!"#B>#%;#I>#; !C'B(># '!;"%&$B #D;%CC'B#";(%%#;#I%;@%(>!@";'C;#I%;�OPF;A'>B@;'C;@ B%&#'B"F;B%?$<>#'B"F;>!@; !H%"#'B"�;Q J%� "%F;>$@ #'B"N;B%R$%"#";"I'$<@;A%;>< ?!%@;� #I;#I%"%;'H%B>B&I !?;!%%@"S;#I>#; "F;#';"$EE'B#;B%"E'!" A<%;EB'?B>(;E%BC'B(>!&%;� #I !;>;"'$!@F;%#I &><;A$" !%"";%!H B'!(%!#�TI <%;#I%;>$@ #; "; !;#I%;E<>!! !?;EI>"%F;(>!>?%=(%!#;"I'$<@;EB'>&# H%<D;�'BJ;� #I;#I%;>$@ #;#%>(;>!@;U%@$&>#%V;#I%;>$@ #'B"�;:";>;B$<%F;A$" !%"";'B;"%&$B #D;(>!>?%B";"I'$<@;EB'H @%;&'!"#B$&# H%; !E$#;'!;#I%;%H><$=># '!;(%#I'@'<'?D;A%C'B%;>$@ #;(>!>?%(%!#;>EEB'H%"; #�;OWE%&#># '!";>B%;>;#�'=�>D;"#B%%#X;(>!>?%(%!#;($"#;I%<E;>$@ #'B";%!"$B%;#I>#;>$@ #;%WE%&#># '!";>B%;>< ?!%@;>!@;#I>#;E>B# & E>!#";$!@%B"#>!@;%>&I;'#I%B�;YB 'B;#';#I%;>$@ #F;(>!>?%B";"I'$<@;&'<<%&#;#I%; !C'B(>=# '!;>!@;@'&$(%!#># '!;!%&%"">BD;#';@%('!"#B>#%;I'�;�%<<;#I%D;(>!>?%;#I% B;'E%B># '!"; !;&'!&%B#;� #I;#I%;'H%B><<;'B?>! K># '!><;A$" !%"";'AG%&# H%"�;�I%D;"I'$<@;A%;EB%E>B%@;#';EB'H @%;>$@ #'B";� #I;%H @%!&%;'C;�%<<=(>!>?%@;"%&$B #D;%CC'B#";>!@;B%"$<#"�;�I ";( ?I#; !&<$@%;@'&$(%!#># '!;'C;"%&$B #D;E<>!"F;"$EE'B# !?;A$@?%#"F;E'< &D;>!@;EB'&%@$B%;(>!$><"F;>"" ?!(%!#";'C;B%"E'!=" A < # %";Z"$&I;>";$E=#'=@>#%;G'A;@%"&B E# '!"[F;B%"$<#";B%E'B# !?;>!@;'#I%B;#B%!@ !?; !C'B(># '!F;>!@;L;!><<DF;>!D;'#I%B;B%<%H>!#;?$ @>!&%;Z#';(>!>?%(%!#;>!@;"#>CC[;#I>#;@%('!"#B>#%";>;U�%<<=B$!V;>!@;E%BC'B( !?;EB'?B>(� �!;"%<%&# !?;@'&$(%!#># '!F;(>!>?%(%!#;"I'$<@;!'#;#BD;#';'H%B<'>@;#I%;>$@ #;#%>(;� #I; !C'B(># '!F;A$#;#';EB'H @%;?%!$ !%; !" ?I#; !#';I'�;#I%; !C'B(># '!;"%&$B #D;EB'?B>(; ";B$!;>!@;I'�;�%<<; #; ";@' !?�;:!; !C'B(># '!;"%&$B #D;(>!>?%(%!#;E%B '@ &;B "J;>""%""(%!#;>!@;#I%;'B?>! K># '!><;A$" !%""; (E>&#;>!><D" ";Z\�:[;>B%;#�';J%D;(>!>?%(%!#;%CC'B#";#';"I>B%;� #I;>$@ #'B"�;]/1/2- -193_9-._3.,05,3953/13/78093abcdefacdeghadfiajkflemnolcakplcfalkalqcamflcefdgadoimlarkdgstaknucjlmvcstawoewksctadwwekdjqtadfiawekjcioecsaxdoimlalcslsyza{fawdelmjogdetascllmfradfadwwekwemdlcawoewkscadfialqcadoimladwwekdjqadecalqcal|ka}kslam}wkeldflacgc}cflsakpacvcehasojjcsspogadoimlzaa~msjossa|mlqadoimla}dfdrc}cflalqcacvdgodlmkfajemlcemdadfiasldfideisadfiaqk|alqcadoimla|mggadjlodgghancajkfiojlcitamfakeicealkacfsoecalqdlahko�ggaecjcmvcada�odgmlhadoimlza�s�a|qclqcealqchadoimlamfadjjkeidfjca|mlqamflcefdlmkfdgasldfideisapkealqcawekpcssmkfdgawedjlmjcakpamflcefdgadoimlmfrzaabcdefa|qkamsakfalqcadoimlalcd}adfialqcmea�odgm�ajdlmkfstaldgcflstadfia}klmvdlmkfsza�qcadoimlalcd}ac�mslsalkaqcgwa}d�cahkoeakwcedlmkfsa}kecacp�ajmcfladfiacppcjlmvctanolalqchadecadgskamfimvmiodgsa|mlqaslecfrlqsadfia|cd�fcsscsajk}}kfalka}dfhac}wgkhccsza{lawdhsalka�fk|alqcac�wcemcfjcakpahkoeadoimlkesta|qclqcealqch�ecaekk�mcsakeavclcedfsaxdfiawceqdwsalkawosqapkealqcagdllceyza�qk|mfradfamflcecslamfalqcmea|ke�ajdfadgskamf�aocfjcadfiamfjecdscalqcancfc�alsapek}alqcadoiml�|mlqmfaecdskfza�lalqcacfiakpalqcaidhtadoimlkesaslmggafccialkancamficwcficfladfiaknucjlmvcza�IB'$?I'$#; #";@ "&$"" '!;� #I;#I%;>$@ #;#%>(;EB 'B;#';#I%;>$@ #F;(>!>?%(%!#;"I'$<@;#BD;#';"#B J%;>;A><>!&%;A%#�%%!; !�;$%!&%;>!@;@%C%B%!&%�;M>!>?%B";"I'$<@;!% #I%B;D %<@;%!# B%<D;#';#I%;>$@ #;#%>(;!'B;( &B'(>!>?%; #";%CC'B#"�;

Page 34: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,--./01230/45603758.903,:;< =%>?!@> !#%A?&# '!>B%#�%%!>C%'CD%E>B$#>C?A# &$D?AD@> !>#F%>�'A=>%!G A'!(%!#E>?>CA'H%"" '!?D>?!I>#A$"# !J>A%D?K# '!"F C> ">?>"#A'!J>CA%&$A"'A>#'>"$&&%""H$D>&'DD?B'A?# '!�>LF%!>(?!?J%A"> !#%A?&#>� #F>#F%>?$I #'A"> !>?>CA'H%"K" '!?D>(?!!%AE>#F%@>#%DD>#F%>?$I #>#%?(>#F?#> #">H$!&# '!> ">A%"C%&#%I>?!I>"$CC'A#%I�>< =%� "%E>D?&=?I? " &?D>%HH'A#">B@>(?!?J%A">?!I>"#?HH>A%M>%&#>C''AD@>'!>#F%>B$" !%"">$! #>'A>CA'&%""E> #">&?C?B D # %"E>?!I> #">C%AH'A(?!&%�>N?!?J%A">"F'$DI>?D"'>%OC%&#>CA'H%"" '!?D> !#%A?&# '!>HA'(>#F%>?$I #>#%?(>?!I>C$"F>B?&=>�F%!%G%A>#F%@>"%%>?!>%O&%C# '!>#'>#F ">CA?&# &%��'>&'!#A B$#%>#'>?>"$&&%""H$D>?!I>?&&$A?#%>?$I #>A%C'A#E>(?!?J%A">"F'$DI>B%>A%&%C# G%>#'>?$I #'A>'B"%AG?# '!">?!I>#F%>?$I #>#%?(P">A%&'((%!I?# '!"�>N?!?J%A">"F'$DI>?D"'>B%>Q>A(>�F%!>I "&$"" !J>?!@#F !J>#F%@>"%%>?"> !&'AA%&#E> !>'AI%A>#'>%!"$A%>#F%A%>?A%>!'>( "$!I%A"#?!I !J"�>R !?DD@E>?D�?@">A%(%(B%AS>(?!?J%A"E>!'#>?$I #'A"E>?A%>A%"C'!" BD%>H'A>I%Q>! !J>?!I> (CD%(%!# !J>"'D$# '!">#'> ""$%">A? "%I>B@>#F%>?$I #�>�F$"E> #> "> !>%G%A@'!%P">B%"#> !#%A%"#>#'>F?G%>?>&''C%A?# G%E>&'DD?B'A?# G%>?$I #>CA'&%"">#F?#>A%"C%&#">#F%> !I%C%!I%!&%>?!I>I "&A%# '!>'H>?DD>C?AK# & C?!#"�>T$I #'A">"F'$DI>D "#%!>#'>(?!?J%(%!#�>T!I>H'A> #">C?A#E>(?!?J%(%!#>"F'$DI>%!&'$A?J%>"#?HH>#'>B%>'C%!>?!I>F'!%"#>� #F>?$I #'A"�>

Page 35: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( ))*++,-./01*2/3456789:531;<=>6:9?1@<A5>6=<AB�C�D%C�'(E$#%FCG(%FH%!&ICJ%"E'!"%C�%K(CL�GJ�MNEKF#C'OC#D%CP'O#�KF%CG!H !%%F !HC�!"# #$#%CLPG�MQCKCO%R%FKSSICO$!R%RCF%"%KF&DCK!RCR%T%S'E(%!#C&%!#%FCK#C�KF!%H %CU%SS'!CV! T%F" #IWCD##EWXX����&%F#�'FHCYCGTKS$K# '!"CZC[FK&# &%"CO'FC�!" R%FC�DF%K#WCD##EWXX����&%F#�'FHX!KTX !R%\]HF%%!�D#(SCYC�'(E$#%FC"%&$F #IC !& R%!#CF%"E'!"%C#%K(CL�P�J�MCR%T%S'E(%!#WCD##EWXX����&%F#�'FHX&" F#"XCYC 'T%F! !HCO'FCG!#%FEF "%CP%&$F #ICL[_ MWCD##EWXX����&%F#�'FHXKF&D T%XEROXab#!acd�EROCYCe$ SRCP%&$F #IC�!C�! # K# T%CL"E'!"'F%RCfIC#D%C_%EKF#(%!#C'OCg'(%SK!RCP%&$F #IC�If%FCP%&$F #IC_ T " '!MWCD##E"WXXf$ SR"%&$F #I !�$"h&%F#�H'TXc�CCiK# '!KSC�!"# #$#%C'OCP#K!RKFR"CK!RC�%&D!'S'HICLi�P�MC�'(E$#%FCP%&$F #ICJ%"'$F&%C�%!#%FCL�PJ�MWCD##EWXX&"F&�! "#�H'TXCYCVPC%R%FKSC�!O'F(K# '!C[F'&%"" !HCP#K!RKFRCL�[PMCcaaQCjU ! ($(CP%&$F #ICJ%k$ F%(%!#"CO'FC%R%FKSC�!O'F(K# '!CK!RC�!O'F(K# '!CPI"#%("lCL[_ MWCD##EWXX&"F&�! "#�H'TXE$fS &K# '!"XmCE"XmCE"caaX�[PhcaahmC!KSh(KF&D�EROCYCi�P�CPE%& KSC[$fS &K# '!CLP[MCnaahbdQCjJ%&'((%!R%RCP%&$F #IC�'!#F'S"CO'FC%R%FKSC�!O'F(K# '!CPI"#%("lCL[_ MWCD##EWXX&"F&�! "#�H'TXE$fS &K# '!"X! "#E$f"XnaahbdXP[naahbd�EROCYCi�P�CPE%& KSC[$fS &K# '!CLP[MCnaahbdoQCj$ R%CO'FCo""%"" !HC#D%CP%&$F #IC�'!#F'S"C !C%R%FKSC�!O'F(K# '!CPI"#%("lCL[_ MWCD##EWXX&"F&�! "#�H'TXE$fS &K# '!"XRFKO#"XP[naahbdoh"ER�EROCYC %R%FKSC�!O'F(K# '!CP%&$F #ICUK!KH%(%!#Co&#CL�PUoMC�(ES%(%!#K# '!C[F'p%&#WCD##EWXX&"F&�! "#�H'TX"%&h&%F#XC d�CC�'FE'FK#%C�!O'F(K# '!CP%&$F #ICq'Fr !HCF'$ECL��Pq MWCD##EWXX !O'#%&D�K &EK�'FHXJ%"'$F&%"XCL$!R%FCP%&$F #ICP#K!RKFR"QCFK(%�'Fr"CK!RC$ R%S !%"MCs_'&$(%!#"CKF&D T%RCfIC#D%Co(%F &K!C�!"# #$#%C'OC�%F# mC%RC[$fS &Co&&'$!#K!#"CLo��[oMWCD##EWXX����K &EK�'FHXtYC��Pq Ce%"#C[FK&# &%"CK!RCU%#F &"C�%K("WCD##EWXX !O'#%&D�K &EK�'FHXJ%"'$F&%"XCL$!R%FCP%&$F #ICP#K!RKFR"QCFK(%�'Fr"CK!RC$ R%S !%"uC��Pq MYC�!O'F(K# '!CP%&$F #ICUK!KH%(%!#CJ%O%F%!&%"CL[_ MWCD##EWXXF%O'F(�D'$"%�H'TXVES'KR%R S%"Xe%"#vca[FK&# &%"vcae fS 'HFKEDI�EROCw�C�PxCcyaaBC !Ci'F#DCo(%F &KWCD##EWXX����cyaaB�&'(Cb�CCVPC%!%FKSCo&&'$!# !HCxOmC&%QCjG\%&$# T%C$ R%WC�!O'F(K# '!CP%&$F #ICUK!KH%(%!#WCz%KF! !HCOF'(Cz%KR !HCxFHK! {K# '!"lWCD##EWXX����HK'�H'TX&H hf !XH%#FE#|o�U_h}nhcBC~�CCU &F'"'O#CP%&$F #ICJ "rCUK!KH%(%!#C$ R%WCD##EWXX����( &F'"'O#�&'(X#%&D!%#X"%&$F #IX#'E &"X&'(ES K!&%K!RE'S & %"X"%&F "rXR%OK$S#�("E\Cy�CC�D%C�!#%F!K# '!KSCPI"#%("CP%&$F #ICG!H !%%F !HCo""'& K# '!CL�PPGoMWCD##EWXX���� ""%K�'FHXCn�CCV�P�CP%&$F #ICo�KF%!%""QC�!O'F(K# '!CP%&$F #ICo$R # !HCEKH%WCD##EWXX����$""%&$F #IK�KF%!%""�'FHXD HDF%"X !O'"%&hK$R # !H�D#(SC}�CC�D%C�%!#%FCO'FC�!#%F!%#CP%&$F #ICL��PMWCD##EWXX����& "%&$F #I�'FHXBa�CC�D%C�!O'F(K# '!CPI"#%("CP%&$F #ICo""'& K# '!CL�PPoMWCD##EWXX���� ""K�'FHXC

Page 36: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,,-./012345�66�7%6�!"# #$#%6'86�!#%9!:;6<$= #'9">6��6?%&$9 #@A67##BACC����#7% :�'9DC !=%E�&8(F='&G =HIJK5L6M;'N:;6�%&7!';'D@6<$= #6M$ =%6OM�<MP6?%9 %"A67##BACC����#7% :�'9DC !=%E�&8(F='&G =HQRJK6L6S�!8'9(:# '!6?%&$9 #@6T:!:D%(%!#6:!=6<""$9:!&%A6<6�:;;6#'6<&# '!68'96�'9B'9:#%6M'U%9!:!&%V6OWXYPA67##BACC����#7% :�'9DC='�!;':=�&8(FZ6;%H[[I\]6L6S�!8'9(:# '!6?%&$9 #@6M'U%9!:!&%A67:#6X 9%&#'9"6_%%=6#'6!'�VA67##BACC����#7% :�'9DC='�!;':=�&8(FZ6;%HRI][6L6Sa$ ;= !D>6T:!:D !D>6:!=6<$= # !D6�!8'9(:# '!6?%&$9 #@VA67##BACC����#7% :�'9DC='�!;':=�&8(FZ6;%HII[]]6[�66b?6M%!%9:;6<&&'$!# !D6c8Z6&%6OM<cP>6ST:!:D%(%!#6W;:!! !D6M$ =%68'96�!8'9(:# '!6?@"#%("6?%&$9 #@6<$= # !DV6OWXYPA67##BACC����D:'�D'UC"B%& :;�B$N"C(D(#B;!�B=86Q�66cB%!6�'(B; :!&%6:!=6d#7 &"6M9'$B6Oc�dMP>6S�!#%9!:;6<$= #6M$ =%6O�<MPVA67##BACC����'&%D�'9DCU %�C�<M6e�66_:# '!:;6<""'& :# '!6'86�'9B'9:#%6X 9%&#'9"6O_<�XP>6S�!8'9(:# '!6?%&$9 #@6cU%9" D7#A6d""%!# :;6a':9=6W9:&# &%"VA67##BACC����!:&='!; !%�'9DCB$N; &:# '!"CB$NX%#: ;"�:"BFB$N�XH5I]6 K�66�!8'9(:# '!6?@"#%("6<$= #6:!=6�'!#9';6<""'& :# '!6O�?<�<P>6S�'!#9';6cNf%&# U%"68'96�!8'9(:# '!6:!=69%;:#%=6�%&7!';'D@6O�ca��PVA67##BACC���� ":&:�'9DC&'N #6R�66�9%:"$9@6a':9=6'86�:!:=:>6�!#%9!:;6<$= #A67##BACC����#N"g"&#�D&�&:C :gU C7'(%g:&&$% ;G%�:"B6L6�!8'9(:# '!6�%&7!';'D@6?%&$9 #@h<$= #6M$ =%A67##BACC����#N"g"&#�D&�&:CB$N"GB';C=&DB$N"C�aGiQCJ5D$ =J5G%�:"B6L6M$ =%6#'6#7%6<$= #6'86?%&$9 #@A67##BACC����#N"g"&#�D&�&:C :gU CB'; & %"gB'; # j$%"CD:"gDU"CD:"gDU"G%�:"B6]�66�7%6�%!#%968'96d=$&:# '!6:!=6k%"%:9&76 !6�!8'9(:# '!6<""$9:!&%6:!=6?%&$9 #@A67##BACC����&%9 :"�B$9=$%�%=$C60lmnopqrsnl2tuvwosrx2+wysrslz2{u|nwovu|

Page 37: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./001-234567899:6;<=>?8<9=@A?=B8;C?@=5D=<?>5E?;5DF=?D@?;G;59?=9?HI;5@J=96K@:8;?=96>I@56D9=K6;=BI>@5K8H@6;=8I@A?D@5H8@56D=8D<=;?<IH5DF=K;8I<=I95DF=@A?=L56B?@;5H=9H5?DH?=6K=C?J9@;6C?=<JD8B5H9M=4J=H;?8@5DF=8=L56B?@;5H=@?BG>8@?=K;6B=I9?;=>6F6D=H;?<?D@58>9=5D=H6BL5D8@56D=:5@A=8=A5FANG?;K6;B8DH?=L?A8E56;8>=L56B?@;5H=G;6H?995DF=?DF5D?O=@A?=<?E5H?N5D<?G?D<?D@=8I@A?D@5H8@56D=96K@:8;?=59=K89@O=8HHI;8@?O=@;8D9G8;?D@O=9H8>8L>?=@6=B5>>56D9=6K=I9?;9O=8D<=5BB?<58@?>J=<?G>6J8L>?=8H;699=@A?=6;F8D5P8@56D=8D<=@A?=QD@?;D?@=:5@A6I@=@A?=D??<=K6;=?RG?D95E?=@6C?D9O=H8;<9O=6;=6@A?;=9G?H58>5P?<=A8;<:8;?M=S95DF=4567899:6;<=@6=B6D5@6;=8D<=8I@A?D@5H8@?=I9?;9O=6;F8D5P8@56D9=H8D=TI5HC>J=8D<=H69@N?KK?H@5E?>J=5BG>?B?D@=9?HI;?=8HH?99O=H6BG>J=:5@A=;?FI>8@6;J=;?TI5;?B?D@9O=8D<=;?<IH?=@A?=;59C9=6K=K;8I<M=U6;=B6;?=5DK6;B8@56D=6D=4567899:6;<=E595@=VVVWXYZ[\]]VZ_WZa=6;=H6D@8H@=I9=8@=bcdefghcijkkllMmn]n\ ogp[Zq]Z

Page 38: Information Security Audit Guidance

����������������� ����������� ��������������� !"# #$#%�&'( )*+,-./0/120+./1-30456078569:6;0<=+;0<>+;0<>7+;0<>77?;0<+?@A!BC�A!"'!B "BABDEFG%AHB !#%H!AIBA$J #BK%#%HA!B�L'B�A"B('"#BH%&%!#IGBJ H%&#'HB'MBNH'M%"" '!AIBNHA&# &%"BA#B#L%B�!"# #$#%B'MB�!#%H!AIBO$J #'H"�BPH 'HB#'BL "B�'HQB� #LB#L%B��ORBC�A!"'!B�A"BA!B !J%N%!J%!#B(A!AS%(%!#B&'!"$IF#A!#BM'HB'K%HBTUBG%AH"�BC�A!"'!BLA"B&'(NI%#%JB !#%H!AIBA$J #BNH'V%&#"BM'HB('H%B#LA!BWUBJ MM%H%!#B'HSA! XA# '!"RB"N%!J !SBAI('"#BTUBG%AH"B !BS'K%H!(%!#BA$J # !SBA#B#L%BM%J%HAIRBNH'K !& AIRBA!JB($! & NAIBI%K%I"RBA!JB#L%BH%"#B !B#L%BNH KA#%B"%&#'HRB(A !IGB !B#L%BYB!A!& AIB"%HK &%"RB#HA!"N'H#A# '!RBA!JBL%AI#LB"%&#'H"�B�L%BA$#L'HB'MB('H%B#LA!BZ[BAH# &I%"B'!B !#%H!AIBA$J # !SBA!JB'#L%HB(A!AS%F(%!#B#'N &"RBC�A!"'!B "B&$HH%!#IGBABMH%%IA!&%B�H #%HBA!JB !J%N%!J%!#B(A!AS%(%!#B&'!"$I#A!#�BC�A!"'!BH%&%!#IGBI%JB#L%B�H # !SB'MB#L%B\�] B !#%H!AIBA$J #BS$ J%BM'HB$"%B !BA$J #"B'MB&'(NI A!&%BA!JB%#L &"BNH'SHA("B_����'&%S�'HSBA!JBNAH# & NA#%JB !B#L%B�\C\B"(AIIBa$" !%""B#A"QBM'H&%B%MM'H#"B#'BNH'K J%BS$ JA!&%BM'HB"(AII%HBN$aI &B&'(NA! %"BH%SAHJ !SB !#%H!AIB&'!#H'IB'K%HBYB!A!& AIBH%N'H# !SB_����&'"'�'HS�BC�A!"'!B "BABH%S$IAHB&'I$(F! "#BM'HBbcdefghijklkkmBA!JBAI"'B�H #%"B#L%B��� BnO$J #'HBO!"�%H"oB&'I$(!�>p0q:r0s5tu0vwu590p:x0vyzx:tv6{0|su0>/0+rwv|0<su}~�v9|9;0z�u59u08xv|u0uwv|:x�v|}v69|v|r|u�}:y�0