Covers information security policy auditing, firewall and threat-detection control review, and how Governance, Risk, and Compliance (GRC) frameworks like NIST, ISO 27001, and COBIT structure a cybersecurity audit program.

Modules

Foundations of Cyber GRC

Lessons

• What GRC Means and Why It Exists Preview
• The Cyber GRC Auditor’s Day-to-Day Role
• Independence and Objectivity in Security Auditing

Information Security Policy Auditing

Lessons

• Reviewing the Policy Framework
• Testing Whether Policy Matches Practice
• Security Awareness and Training Controls

Firewall and Network Control Auditing

Lessons

• Auditing Firewall Rule Sets
• Network Segmentation Testing
• Remote Access and VPN Controls

Threat Detection and Monitoring Controls

Lessons

• Auditing SIEM and Log Management
• Endpoint Detection and Response (EDR) Controls
• Vulnerability Management and Threat Intelligence

GRC Frameworks - NIST ISO 27001 and COBIT

Lessons

• The NIST Cybersecurity Framework
• ISO 27001 and the ISMS
• COBIT and Governance-Focused Frameworks

Reporting Cyber Risk to Stakeholders

Lessons

• Translating Technical Risk Into Business Terms
• Building a Cyber Risk Dashboard
• Communicating Findings Through the Reporting Chain