Protection of Information Assets (ISACA)

Auditing the protection of information assets is grounded in understanding the principles of security and privacy: information asset security frameworks/standards/guidelines, privacy principles, and data classification. The purpose of data classification is to ensure that all data or information receives an appropriate level of protection.

Every standard has value because it provides a structure that a security program can be modeled on, and that auditors can review against. Auditing standards are also cross-recognized: a review performed against ISO 27001, for example, is generally accepted worldwide. However, every standard must be tailored to the organization — a military organization, a government agency, a not-for-profit, and a commercial enterprise are all different, so the standard must be implemented in a way suitable to that specific organizational context. The auditor's job is not to check whether the organization did things identically to every other organization, but whether the standard was implemented appropriately for that organization — and whether it is actually enforced (e.g., configurations are checked against minimum security baselines), not merely documented.

...