Requirement
Results from the cybersecurity audits and reviews must be documented and presented to the cybersecurity steering committee and Authorizing Official. Results must include the audit/review scope, observations, recommendations and remediation plans.
Control Implementation Guidelines
- Review and document results of cybersecurity review and audit. The review report must include:
- 1
- Scope of review and audit
- Discovered observations
- Recommendations and corrective actions
- Observations remediation plan
- Share and discuss the results of cybersecurity review and audit with the cybersecurity supervisory committee and the representative
Relevant Cybersecurity Tools
- Cybersecurity Review Report Template.
Expected Deliverables
- A document (such as approved policy or procedure) indicating the identification and documentation of the requirements related to this control
- Audit reports (by the internal audit department or compliance department or an independent external auditor) on all cybersecurity requirements of the organization
- Evidence that the results of the cybersecurity review and audit presented to the cybersecurity supervisory committee and the representative
