Information Systems & Controls (ISC) Cheat Sheet

NIST Frameworks

The National Institute of Standards and Technology provides key cybersecurity and privacy guidance.

Cybersecurity Framework (CSF) Core

Consists of 6 core functions for managing cybersecurity risks:

• Govern: Establish and monitor the organization's cybersecurity risk management strategy.
• Identify: Understand assets, business environment, and risks.
• Protect: Implement safeguards and access control.
• Detect: Monitor for and identify cybersecurity events.
• Respond: Take action upon detecting an incident.
• Recover: Restore systems and return to normal operations.

Implementation Tiers

Shows the effectiveness of organizational profiles.

• Tier 1 (Partial): Least sophisticated; ad-hoc, reactive risk management.
• Tier 2 (Risk-Informed): Aware of risks but management is not formalized.
• Tier 3 (Repeatable): Formal, repeatable policies and procedures.
• Tier 4 (Adaptive): Most sophisticated; proactive, continuous improvement based on incidents.

Framework Profiles

Profiles indicate a company's cybersecurity position.

• Current Profile: Where the company is now.
• Target Profile: Where the company wants to be.
• Community Profile: Industry profile used to develop an organization's profile.

NIST CSF 2.0 Organizational Profiles (5-Step Gap Analysis)

Profiles represent the alignment of cybersecurity requirements and objectives with organizational risk appetite:

1. Scope the Organizational Profile: Determine business drivers, organizational scope, and system boundaries.
2. Gather Information: Collect organizational policies, risk assessments, business objectives, and regulatory requirements.
3. Create the Organizational Profile: Document the Current Profile (as-is state) and Target Profile (desired state).
4. Analyze Gaps & Negotiate Action Plan: Compare Current vs. Target Profile to identify control gaps and prioritize remediation.
5. Implement the Action Plan: Execute prioritized safeguards and continuously adjust based on emerging risks.

NIST Privacy Framework Core: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P. Manages privacy risk arising from enterprise data processing while utilizing identical Profiles and Tiers (1–4).

NIST Security and Privacy Controls (SP 800-53)

Provides controls to protect information systems from sophisticated threats using three implementation approaches:

• Common (Inheritable): Controls at the organizational level.
• System-Specific: Controls at the information system level.
• Hybrid: A mix of both organizational and system-level controls.

Key Data Regulations

GDPR (General Data Protection Regulation)

European Union law regulating data privacy. It applies to data controllers and processors based in the EU, as well as those outside the EU who offer goods/services to or monitor individuals inside the EU.

• Lawfulness, fairness, and transparency: Process data legally, fairly, and transparently.
• Purpose limitation: Collect data for specified, explicit, and legitimate purposes only.
• Data minimization: Limit data collection to what is necessary for the intended purpose.
• Accuracy: Keep personal data accurate and up to date.
• Storage limitation: Retain data only as long as necessary for the processing purpose.
• Integrity and confidentiality: Ensure appropriate security, integrity, and privacy of the data.
• Accountability: Take responsibility for compliance and be able to demonstrate it.

GDPR & Transatlantic Data Transfers

• Scope: Applies to EU data controllers/processors and non-EU entities offering goods/services to or monitoring behavior of individuals in the EU.
• Key Data Subject Rights: Right to Access, Right to Rectification, Right to Erasure ("Right to be Forgotten"), Right to Data Portability, and Right to Restrict Processing.
• Supervisory Breach Notification: Controllers must notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach posing risk to individual rights.
• Transatlantic Transfer Mechanisms: Safe Harbor (invalidated 2015) and Privacy Shield (invalidated 2020) were replaced by the EU-U.S. Data Privacy Framework (2023–Present) as the lawful transfer mechanism.

HIPAA Privacy, Security & Breach Notification Rules (HITECH)

Payment Card Industry (PCI DSS)

A framework with 6 goals and 12 requirements for protecting cardholder data, based on the PCI Data Security Standard (PCI DSS v4.x).

PCI DSS 6 Goals & 12 Principal Requirements

Applies to all entities storing, processing, or transmitting Cardholder Data (CHD) or Sensitive Authentication Data (SAD):

COBIT 2019 Framework

A framework developed by ISACA to implement best practices for the governance and management of enterprise Information and Technology.

Governance vs. Management

Governance evaluates, directs, and monitors (EDM). Management plans, builds, runs, and monitors daily administration.

• Internal Stakeholders: Board of Directors (BoD), Management, Managers, etc.
• External Stakeholders: Investors, regulators, business partners, etc.

COBIT Core Model Domains

• Evaluate, Direct, and Monitor (EDM): Governance domain evaluating strategic objectives and directing management.
• Align, Plan, and Organize (APO): Focuses on IT's overall strategy, organization, and supporting activities.
• Build, Acquire, and Implement (BAI): Addresses acquiring and implementing IT solutions into business processes.
• Deliver, Service, and Support (DSS): Addresses the daily delivery, service, and support of IT services.
• Monitor, Evaluate, and Assess (MEA): Addresses IT conformance to the company's performance targets.

Governance System Principles

Six principles describing a good governance system:

1. Provide Stakeholder Value: Create value by balancing benefits and risks.
2. Holistic Approach: Use all components across the organization for strong governance.
3. Dynamic Governance System: Adapt to changing technologies, risks, and needs.
4. Governance Distinct From Management: Separate management and governance activities.
5. Tailored to Enterprise Needs: Models should be tailored to each company's specific requirements.
6. End-to-End Governance System: Cover all business processes, not just the IT department.

COBIT 2019 Design Factors

The 11 Design Factors customize the core model into a tailored enterprise governance system:

The 11 Design Factors

1. Enterprise Strategy
2. Enterprise Goals
3. Risk Profile
4. IT-Related Issues
5. Threat Landscape
6. Compliance Requirements
7. Role of IT
8. Sourcing Model for IT
9. IT Implementation Methods
10. Enterprise Size
11. Industry Sector

Role of IT Governance Classification (Factor 7)

• Support: IT is not critical to daily operations or strategic innovation.
• Factory: IT is critical for daily operational continuity, but not for future strategic innovation.
• Turnaround: IT is not critical for daily operations now, but is essential for future strategic business transformation.
• Strategic: IT is absolutely critical for both daily operational continuity and long-term strategic competitive advantage.

COSO Frameworks

Guidance for internal controls, enterprise risk management, and fraud deterrence.

Internal Control Framework

Relates to policies and procedures ensuring management guidelines are applied and objectives achieved.

• Control Environment: The overall control culture, covering board oversight, ethics, and retaining competent employees.
• Risk Assessment: Identifying risks, considering potential fraud, and understanding changes impacting controls.
• Information and Communication: Obtaining, generating, and controlling internal and external communication.
• Monitoring Activities: Ongoing evaluations of control activities and communicating deficiencies.
• Control Activities: Policies and procedures established by management to mitigate risks to the achievement of objectives (e.g., authorizations, reconciliations, segregation of duties, IT general controls, and application controls).

Enterprise Risk Management (ERM) Framework

Integrates with strategy and performance.

• Governance and Culture: Sets the organization's tone and reinforces risk oversight.
• Strategy and Objective-Setting: Aligns risk appetite with strategy during planning.
• Performance: Identifies, assesses, prioritizes, and responds to risks.
• Review and Revision: Reviews performance over time and makes revisions.
• Information, Communication, and Reporting: Continual process for sharing risk info.

Center for Internet Security (CIS) Controls

A prioritized set of 18 best practices to mitigate common cyber attacks, maintained by the Center for Internet Security.

Implementation Groups (IGs)

• IG1 (Basic): Small/medium-sized org, limited cybersecurity defense.
• IG2 (Foundational): Bigger org, sensitive data; includes IG1.
• IG3 (Organizational): Biggest org, highly sensitive data; includes IG1 & IG2.

Controls 1-9 (Basic & Foundational)

• Inventory & Control: Track all hardware (C1) and software (C2) to block unauthorized assets.
• Data Protection: Securely manage, protect, and classify data based on sensitivity (C3).
• Secure Configuration: "Harden" configurations of systems and software to reduce vulnerabilities (C4).
• Account & Access Control Management: Manage credentials (C5) and ensure users only have access necessary for their duties (C6).
• Continuous Vulnerability Management: Continuously scan and remediate infrastructure vulnerabilities (C7).
• Audit Log Management: Establish log management (C8) for system logs, audit logs, and event logs.
• Email & Web Browser Protections: Protect against cybercrimes via email or internet by engaging employees (C9).

Controls 10-18 (Operational & Organizational)

• Malware Defenses: Prevent installation and propagation of malware across network (C10).
• Data Recovery: Establish processes to restore data to a pre-incident state (C11).
• Network Infrastructure Management: Secure infrastructure like firewalls and routers (C12).
• Network Monitoring: Defend infrastructure against internal/external threats (C13).
• Security Awareness: Provide skills training to employees to reduce risk (C14).
• Service Provider Management: Evaluate third-party providers with access to sensitive data (C15).
• Application Software Security: Identify and fix vulnerabilities throughout the software lifecycle (C16).
• Incident Response: Establish a program to detect, respond, and prepare for attacks (C17).
• Penetration Testing: Simulate attacks to find and exploit weaknesses (C18).

System and Organization Controls (SOC) Framework

SOC reports provide assurance over the controls at a service organization for a user entity.

SOC Engagement Matrix

Trust Services Criteria (SOC 2 & SOC 3)

• 1. Security (Common Criteria - CC Series): MANDATORY in all SOC 2 and SOC 3 reports. Information and systems are protected against unauthorized access, disclosure, and damage. Incorporates COSO 2013 internal control principles across 9 categories:
  • CC1: Control Environment | CC2: Communication and Information | CC3: Risk Assessment
  • CC4: Monitoring Activities | CC5: Control Activities | CC6: Logical and Physical Access Controls
  • CC7: System Operations | CC8: Change Management | CC9: Risk Mitigation
• 2. Availability (A Series - Optional): Information and systems are operational and accessible to meet service commitments (capacity management, environmental controls, DRP).
• 3. Processing Integrity (PI Series - Optional): System processing is complete, valid, accurate, timely, and authorized (input validation checks, error logs).
• 4. Confidentiality (C Series - Optional): Information designated as confidential is protected per legal agreements (encryption, access restrictions, disposal).
• 5. Privacy (P Series - Optional): Personal information is collected, used, retained, disclosed, and disposed of in conformity with the entity's privacy notice and GAAP/AICPA privacy principles.

Exam Tip: Security requires no additional criteria beyond the Common Criteria (CC series).

Type 1 vs. Type 2 SOC Reports Comparison

Subservice Organizations: Inclusive vs. Carve-Out Methods

Complementary Controls: CUECs and CSOCs

• Complementary User Entity Controls (CUECs / UCCs): Controls that the service organization assumes will be implemented by User Entities to achieve SOC 1 control objectives or SOC 2 service commitments. Disclosures are REQUIRED in the service organization's system description.
  • Examples: Promptly notifying the service org of terminated staff, maintaining local workstation password complexity, reconciling monthly output reports against internal GL balances.
• Complementary Subservice Organization Controls (CSOCs): Controls that a subservice organization must execute for the primary service organization's controls to function effectively under the Carve-Out method.
• Mandatory Auditor Opinion Statement: When CUECs or CSOCs are necessary to achieve control objectives or criteria, the service auditor's opinion section MUST INCLUDE an explicit statement confirming that control objectives can be achieved only if complementary controls are operating effectively at user entities / subservice organizations.

SOC Engagements: Reporting & Auditing

SOC Engagement Independence & Materiality Rules

• Auditor Independence Rules:
  • The service auditor must be independent of the service organization.
  • The service auditor is NOT required to be independent of each individual user entity.
  • If the Inclusive Method is used for a subservice organization, the auditor must also be independent of the subservice organization.
  • If required by law/regulation to accept an engagement where independence is impaired, the auditor must disclaim an opinion and state all reasons for lack of independence.
• Materiality Concepts in SOC Engagements:
  • SOC 1® Materiality: Evaluates whether misstatements or deficiencies distort the fair presentation of the description or control suitability/operation regarding user entities' ICFR. It does NOT relate to user entities' financial statements.
  • SOC 2® Materiality: Evaluates the likelihood and magnitude of risks that could affect the service organization's ability to achieve its service commitments and system requirements under the Trust Services Criteria.

Misstatements, Exceptions, and Control Deficiencies

Standard 5-Section SOC Report Breakdown

Service Auditor Opinion Phrasing & Modifications

Subsequent Events & Management Representation Letter

Management Representation Letter Mandates:

• Must be dated as of the date of the service auditor's report.
• A SOC report CANNOT be issued until the representation letter is received.
• If the Inclusive Method is used, written representations must also be obtained from the subservice organization.
• Management's refusal to provide written representations constitutes a severe Scope Limitation, requiring the auditor to Disclaim an Opinion or withdraw from the engagement.

System Development & Change Management

Controls to ensure changes to applications and infrastructure are authorized, tested, and approved, mitigating the risk of unauthorized modifications.

Environments & Testing

Systems must progress through segregated environments to ensure stability (Development -> Staging/Test -> Production).

• Unit Testing: Testing individual functions or components in isolation.
• Integration Testing: Verifying that different modules work together correctly.
• System Testing: Evaluating the complete, integrated system's compliance with requirements.
• User Acceptance Testing (UAT): Final validation by end-users before going live.

Development Methodologies

• Waterfall: A rigid, sequential approach where phases are completed one after another.
• Agile: An iterative approach focusing on flexibility and short development cycles (sprints).
• CI/CD (Continuous Integration / Continuous Deployment): Automated pipelines that build, test, and deploy code changes quickly and safely.

System Conversion Approaches

• Direct (Cutover): Turn off the old system, turn on the new (High risk).
• Parallel: Run both simultaneously for a period (Low risk, high cost).
• Phased: Implement in modules or stages over time.
• Pilot: Implement fully for a small, select group of users first.

Change Management Governance (10 Key ITGC Controls)

1. Formal Policies & Procedures: Documented, management-approved change management framework.
2. Standardized Change Requests: Uniform ticketing detailing business justification, technical scope, and risk.
3. Impact & Risk Assessment: Evaluation of security, availability, and operational dependencies.
4. Explicit Management Authorization: Documented approval before code or configuration promotion.
5. Segregation of Duties (SoD): Developers who write code are strictly prohibited from approving changes or deploying to production.
6. Pre-Implementation QA Testing: Rigorous unit, integration, and user acceptance testing in non-production environments.
7. Data Conversion Controls: Validation scripts ensuring completeness and accuracy during legacy data migration.
8. Backout / Rollback Plans: Tested contingency procedures to revert failed deployments immediately to a known good state.
9. Post-Implementation Review: Post-deployment testing in production to verify operational stability.
10. Ongoing Audit Monitoring: Continuous log review to verify that only authorized, tested changes were deployed.

Governance Structures:

• Change Advisory Board (CAB): Cross-functional committee that reviews high-risk changes, assesses enterprise risk, and authorizes production deployment schedules.
• Baseline Configuration: Formally documented, tested, and approved hardware/software configuration state used to detect unauthorized configuration drift.
• System Component Inventory: Comprehensive repository of all enterprise IT assets, software versions, and patch levels.

CI/CD Pipeline ITGC Control Testing

Modern DevOps environments utilize Continuous Integration / Continuous Deployment (CI/CD) pipelines. Auditors must test automated controls embedded within pipeline configurations:

Patch Management Lifecycle (6 Steps)

The structured sequence for remediating software and firmware vulnerabilities across enterprise endpoints and servers:

1. Prioritize: Assess vulnerabilities using Common Vulnerability Scoring System (CVSS) scores and enterprise asset criticality.
2. Schedule: Assign patching rollout windows based on emergency hotfixes vs. standard monthly maintenance cycles.
3. Validate: Verify digital signatures and cryptographic hash checksums of vendor patch packages before ingestion.
4. Test in QA: Deploy patches into isolated staging/test environments to identify operational conflicts or crashes.
5. Deploy: Roll out approved patches systematically across production endpoints using automated patch management tools.
6. Monitor: Review post-deployment logs, vulnerability scans, and telemetry to verify successful remediation and stability.

Configuration Parameter Controls: Establishing hardened baseline configurations, restricting configuration parameter file access, automated alerting on configuration drift, and periodic auditing against CIS Benchmarks.

Enterprise Hardware & Infrastructure Housing

IT infrastructure encompasses hardware, software, network resources, and physical facilities required to deliver enterprise services.

Core Network Hardware

The fundamental physical and virtual devices that enable network connectivity, communication, and boundary security.

Network Intermediaries & Signal Modifiers

• Modem: Modulator-Demodulator converting analog signals from an ISP into digital signals for internal routers. Has a unique public IP address.
• Router (Layer 3): Connects disparate networks; reads IP addresses, assigns dynamic internal IPs via DHCP, and determines optimal packet routing.
• Switch (Layer 2): Connects devices within the same LAN; forwards frames directly to destination ports using hardware MAC addresses.
• Hub (Layer 1): Legacy device broadcasting incoming data packets to all ports simultaneously, causing packet collisions and security risks.
• Gateway: Protocol translator converting packet formats between two disparate, incompatible network protocols.
• Bridge: Filters and forwards traffic between two separate network segments that use the same communication protocol.
• Access Point (AP): Enables wireless Wi-Fi devices to connect directly to a wired Ethernet backbone.
• Signal Modifiers: Amplifiers (boost raw signal and noise), Repeaters (regenerate and clean digital signals), Concentrators (multiplex data streams).

Perimeter Boundary Defenses

• Demilitarized Zone (DMZ): A physical or logical perimeter subnetwork isolating external-facing corporate servers (web, mail, public DNS) from the internal private LAN.
• Virtual Private Network (VPN): Encrypted logical tunnel over the public internet providing secure remote endpoint access.
• Software-Defined WAN (SD-WAN): Dynamically routes traffic across multiple transport links (broadband, MPLS, 5G) to optimize application latency.

Firewall Architecture Generations

Data Loss Prevention (DLP - 3 Tiers)

• Network-Based DLP: Monitors email, web traffic, and FTP at perimeter egress points to detect sensitive data exfiltration.
• Endpoint-Based DLP: Software on user workstations monitoring local file transfers, USB drives, clipboard copy-pasting, and printing.
• Cloud-Based DLP: Integrates with SaaS/cloud storage to enforce data classification and access policies on shared cloud files.

Enterprise Logging Architecture

Comprehensive logging provides an immutable audit trail for forensic investigation, compliance verification, and real-time security alerting via SIEM platforms.

Network Topologies & OSI Model

Network Topologies

The physical layout or arrangement of equipment (nodes) in a network.

• Star: Data passes through a central hub or switch. If a hub fails, only the nodes connected to it stop working.
• Mesh: Features numerous connections between nodes, promoting network stability if one node is damaged, but can be costly to implement.
• Ring: Nodes are connected in a circular path. This can result in very slow network performance.
• Bus: Nodes are connected to a single line/cable. If the central line is compromised, the entire network goes offline.

OSI 7-Layer Model

A conceptual framework developed by ISO that segregates network functions into seven different layers to explain how devices communicate.

• Layer 7 (Application): Interface between user applications and the network.
• Layer 6 (Presentation): Transforms data into a format that other devices can interpret.
• Layer 5 (Session): Establishes and maintains sessions between devices.
• Layer 4 (Transport): Controls communication connections between devices.
• Layer 3 (Network): Adds routing and addressing headers to data.
• Layer 2 (Data Link): Formats data packets for transmission.
• Layer 1 (Physical): Converts messages into bits for physical transmission.

Cloud Computing

The delivery of computing services over the internet. According to the COSO ERM for Cloud Computing guidance, while management can outsource IT operations to a Cloud Service Provider (CSP), they cannot outsource the responsibility for the governance and risk management of their data.

Cloud Service Models (Shared Responsibility)

Deployment Models

• Public: Owned and managed by a CSP and made available to multiple organizations over the public internet.
• Private: Created for a single organization and exists on or off the organization's premises.
• Hybrid: Composed of two or more clouds (e.g., one private, one public) enabling data portability between them.

COSO ERM Cloud Governance & Software Hierarchy

Applying COSO ERM to Cloud Governance:

1. Internal Environment: Sets risk appetite and governance tone regarding third-party cloud adoption.
2. Objective Setting: Aligns cloud strategy with enterprise operational and financial goals.
3. Event Identification: Identifies external CSP outages, vendor lock-in, and regulatory changes.
4. Risk Assessment: Evaluates multi-tenancy risks, data jurisdiction, and CSP financial viability.
5. Risk Response: Enforces SLAs, encryption key management, and cyber insurance coverage.
6. Control Activities: Implements IAM policies, API authentication, and automated audit logging.
7. Information & Communication: Establishes continuous monitoring and security incident reporting.
8. Monitoring: Conducts regular reviews of CSP SOC 1 and SOC 2 Type 2 attestation reports.

Software Architecture Hierarchy:

• Firmware (BIOS / UEFI): Low-level software flashed onto non-volatile ROM, initializing hardware at boot.
• Operating System (OS): System software managing hardware resources, memory, file systems, and scheduling.
• Application Software: User-facing programs executing specific business tasks (e.g., ERP, SQL engines, BI tools).

Testing IT Controls & Walkthroughs

Procedures used by auditors to assess the design and operating effectiveness of IT controls, heavily utilized in SOC engagements.

Walkthroughs

Tracing a transaction from its origination through the information system to its final reporting. This helps the auditor:

• Confirm their understanding of the documented process flow (e.g., flowcharts, narratives).
• Identify points where a material misstatement or control failure could occur.
• Verify that controls have been implemented as designed.

Testing Operating Effectiveness

Evaluating Deviations

When testing reveals an exception, the auditor must classify the deviation:

• Suitability of Design Deficiency: The control is missing or fundamentally flawed — it cannot prevent/detect the risk even if operating as intended.
• Operating Effectiveness Deviation: The control is properly designed but was not applied consistently or correctly by personnel.

Cyberattacks & Threat Intelligence

Stages of a Cyber-Attack (Lockheed Martin Cyber Kill Chain®)

1. 1. Reconnaissance: Harvesting target intelligence, identifying public vulnerabilities, email addresses, and network topology (OSINT, network scanning).
2. 2. Weaponization: Coupling an exploit with a malicious payload/backdoor into a deliverable package (e.g., infected PDF or macro-enabled Office doc).
3. 3. Delivery: Transmitting the weaponized payload to the victim system (e.g., phishing email, malicious URL, or compromised USB drop).
4. 4. Exploitation: Triggering the payload by exploiting software flaws, operating system vulnerabilities, or tricking user execution.
5. 5. Installation: Establishing persistence on the host by installing rootkits, backdoors, web shells, or scheduled tasks.
6. 6. Command & Control (C2): Establishing an encrypted, outbound communication channel back to adversary infrastructure to control the compromised host.
7. 7. Actions on Objectives: Fulfilling the attack goal—data exfiltration (confidentiality breach), file encryption (ransomware availability breach), or record alteration (integrity breach).

Exhaustive Cyberattack Classification & Vectors

Mobile & IoT Threats

• Internet of Things (IoT): Edge smart devices often run unpatchable legacy firmware, lack physical tamper detection, and retain hardcoded vendor credentials, making them primary vectors for recruitment into Mirai-style distributed denial-of-service (DDoS) botnets. Mitigated via network micro-segmentation and 802.1X device profiling.
• Mobile & BYOD: Unmanaged personal devices accessing corporate resources increase exposure to untrusted application stores, OS-level rooting/jailbreaking, and corporate data leakage. Mitigated via Mobile Device Management (MDM) / Unified Endpoint Management (UEM) with remote wipe capabilities and containerized corporate work profiles.

Threat Modeling & Redundancy Frameworks

Structured frameworks to identify vulnerabilities, categorize attack types, and prioritize defensive mitigations.

STRIDE Threat Methodology

Alternative Threat Frameworks & Lifecycle

• PASTA (Process for Attack Simulation and Threat Analysis): A 7-step, risk-centric methodology aligning countermeasures with the business impact of protected assets.
• VAST (Visual, Agile, and Simple Threat): Agile-based threat modeling integrated directly into continuous software development workflows.

Threat Modeling 6-Phase Lifecycle:

1. Identify Assets
2. Identify Threats
3. Reduction Analysis (Decompose App)
4. Analyze Impact
5. Develop Countermeasures
6. Review & Evaluate

Defensive Security Concepts

Zero Trust

A security model that eliminates implicit trust by requiring continuous verification for all users and devices, assuming the network is always at risk. It focuses on users, assets, and resources in real time to determine access.

Least Privilege & Need-to-Know

• Least Privilege: Focuses on the minimum level of access and permissions a user needs to perform their job role.
• Need-to-Know: Focuses on the specific data a user needs to perform their job, which is more granular than least privilege.

Access Control & Authorization Models

System Hardening

A comprehensive security approach that reduces risk by minimizing the number of access points (attack vectors) through which a company can be attacked.

Defense-in-Depth

A multilayered security strategy that combines people, policies, and technology. It uses redundant controls to ensure that a failure in one layer does not compromise the entire system.

Data Encryption & Authentication

Cryptographic protections and access controls ensuring Confidentiality, Integrity, and Non-Repudiation.

Symmetric vs. Asymmetric Cryptography

Digital Signature Creation & Verification Workflow

Security Properties Guaranteed: Authentication (proven origin), Data Integrity (no tampering), and Non-Repudiation (sender cannot deny signing).

Identity & Authentication Mechanisms

• MFA Factor Categories (Requires 2+ Distinct Categories):
  • Something You Know: Passwords, PINs, passphrases, knowledge-based security answers.
  • Something You Have: Physical smart cards, TOTP hardware tokens, authenticator mobile apps.
  • Something You Are: Biometrics (fingerprints, facial geometry, retina scans).
• Hardware Authentication Tokens:
  • Synchronous Tokens (TOTP): Time-based one-time password generators where the physical token's internal clock is synchronized with the authentication server.
  • Asynchronous Tokens: Challenge-response password generators using shared mathematical seeds without clock synchronization.
• Context-Aware vs. Device Authentication: Context-aware evaluates user environment telemetry (time of day, geolocation, IP); device authentication verifies the requesting physical hardware via MAC/IP/certificate.
• Single Sign-On (SSO): Centralized session authentication enabling a user to authenticate once and access multiple authorized applications without re-entering credentials.
• Zero Trust Network Architecture (ZTNA): Assumes the internal network is hostile; enforces micro-segmentation, continuous per-session validation, and explicit least privilege.

Incident Response Plan (IRP) Lifecycle

A formal plan for categorizing, managing, and responding to cybersecurity events and breaches.

Security Event & Incident Escalation Hierarchy

Incident Response Frameworks: NIST (4-Phase) vs. SANS (6-Phase)

Incident Response Operational Metrics:

• Mean Time to Detect (MTTD): Average duration between initial security compromise and formal detection.
• Mean Time to Acknowledge (MTTA): Average duration from initial system alert to response team triage.
• Mean Time to Contain (MTTC): Average duration required to isolate compromised systems and prevent lateral movement.
• Mean Time to Repair / Recover (MTTR): Average duration required to restore systems to full production operations.

Vulnerability Management & Cyber Insurance

NIST Risk Management Process

• Framework: Establish risk context, governance strategy, risk assumptions, and organizational risk tolerance.
• Assess Risk: Identify vulnerabilities, assess threat likelihood, and evaluate potential business impact.
• Respond to Risk: Develop, evaluate, and implement organizational risk responses (Mitigate, Transfer, Accept, Avoid).
• Monitor Risk: Continuously evaluate the operational effectiveness of implemented risk responses over time.

Security Assessment Reports (SAR) & Cyber Insurance

SAR Control Ratings: Assessors evaluate controls via Examination, Interviewing, and Testing, rating controls as either Satisfied (S) or Other than Satisfied (O).

10 Mandatory Cyber Insurance Underwriting Prerequisites:

1. Mandatory employee background checks
2. Documented compliance with relevant data privacy regulations
3. Existence of a tested Disaster Recovery Plan (DRP)
4. Mandatory workforce cybersecurity awareness training
5. Formal, approved Information Security policies
6. Independent third-party cybersecurity risk assessments
7. Documented, tested Incident Response Plan (IRP)
8. Standard perimeter technical controls (firewalls, anti-malware, EDR)
9. Mandatory annual penetration testing
10. Full disclosure of prior historical cyber losses and claims

Quantitative Risk & Phishing Metrics

Mathematical calculations used during Business Impact Analysis (BIA) and security awareness evaluations.

Quantitative Risk Assessment Formulas

Phishing Campaign Simulation Metrics

Business Resiliency & Disaster Recovery

Core Concepts

• Business Resiliency: Ability to continue or quickly return to operations after a disruption.
• Business Continuity (BCP): Focuses on keeping business operational during a disaster.
• Disaster Recovery (DRP): Focuses on restoring IT infrastructure after a disaster.

BIA 7-Step Execution Process

1. Establish BIA Approach: Define scope, governance, and assessment methodology.
2. Identify Critical Resources: Catalog core business processes, IT systems, and interdependencies.
3. Define Disruption Impacts: Evaluate financial, operational, regulatory, and reputational fallout over time.
4. Estimate Losses & Perform Risk Calculations: Calculate ARO, SLE, and ALE for potential disruption scenarios.
5. Establish Recovery Priorities: Rank processes and define recovery metrics (MTD, RTO, RPO).
6. Create BIA Report: Present formal findings, risk rankings, and resource requirements to executive leadership.
7. Implement Action Plan: Integrate recovery targets into BCP and DRP operating plans.

System Availability & Resilience Metrics:

• Mean Time Between Failures (MTBF): Average operational running time elapsed between system failures (evaluates hardware/software reliability).
• Mean Time to Repair (MTTR): Average duration required to diagnose, repair, and restore a failed system component to production (evaluates maintainability).
• Maximum Tolerable Downtime (MTD): Maximum outage duration a business can endure before suffering irreversible, fatal harm.
• Recovery Point Objective (RPO): Targeted maximum allowable duration of data loss measured backward from point of failure.
• Recovery Point Actual (RPA): Actual historical timestamp to which data is successfully restored following disruption.
• Recovery Time Objective (RTO): Targeted maximum duration allowed to restore business operations to a defined state.
• Recovery Time Actual (RTA): Actual clock time required to restore operations to the target state during a recovery event.

Disaster Recovery Alternate Sites

Backup Methodologies Comparison & 3-2-1 Rule

The 3-2-1 Backup Rule: Maintain at least 3 copies of critical data, across 2 different physical storage media types (e.g., disk and tape), with at least 1 copy stored offsite or in a geographically segregated cloud region.

Security Procedures Testing & Simulations

Methods used by internal auditors and security teams to validate that documented incident response and disaster recovery procedures are functional.

Testing Methodologies

Formal Walk-Through 6-Step Methodology

1. 1. Planning: Define walkthrough scope, objectives, and participate with key process owners.
2. 2. Understand Process: Review policies, procedures, process flows, and prior-year workpapers.
3. 3. Perform Walk-Through: Trace a single representative transaction end-to-end through manual and automated systems.
4. 4. Documentation: Validate process flowcharts, control matrices, and identified risk points.
5. 5. Testing: Confirm controls operate as designed and verify automated IT application controls.
6. 6. Evaluation & Report: Document control exceptions, evaluate design deficiencies, and report findings.

Data Life Cycle & Repositories

The sequence data goes through from creation to final disposition.

Data Life Cycle Stages

Data Repositories & Schemas

Data Modeling Stages

Relational Database Normalization

Relational DB Keys & Referential Integrity

• Primary Key (PK): Unique identifier for each record in a table. Must be unique and cannot contain NULL values.
• Foreign Key (FK): An attribute in one table that references the Primary Key of another table, establishing a relationship.
• Composite Key: A primary key formed by combining two or more attributes to uniquely identify a record.
• Referential Integrity Rule: Prevents orphan records; a Foreign Key value must either match an existing Primary Key in the referenced parent table or be NULL.

Data Obfuscation & Media Sanitization

Techniques to protect sensitive data at rest and ensure irreversible sanitization upon asset decommissioning.

Data Masking & Obfuscation Techniques

Media Sanitization Guidelines (Clear, Purge, Destroy)

Technical Sanitization Concepts:

• Degaussing: Exposing magnetic media (tapes, HDDs) to powerful magnetic fields, completely erasing data and destroying HDD read heads. (Note: Ineffective on Solid-State Drives / SSDs).
• Cryptographic Erase (CE): Purging encrypted media by cryptographically shredding / destroying the master decryption key, rendering all underlying ciphertext permanently unrecoverable.

Structured Query Language (SQL)

A standardized programming language used to extract, manage, and manipulate data within a relational database.

SQL Execution Order (Mental vs. Physical Execution)

SQL JOIN Types Matrix

Business Process Documentation: BPMN, DFD & Flowcharts

Visual documentation standards used by IT auditors to evaluate internal control workflows and business systems.

BPMN 2.0 Core Visual Notations

Data Flow Diagrams (DFD) Levels & Symbols

Systems Flowcharting Symbols & Techniques

AIS & ERP Systems

Enterprise Resource Planning (ERP)

A cross-functional system that supports different business functions and integrates information from across departments (accounting, finance, HR) into a centralized database.

Accounting Information Systems (AIS)

The system that collects, records, stores, and compiles accounting information using accounting rules to report financial and nonfinancial information to decision makers.

AIS Subsystems

• Transaction Processing System (TPS): Converts economic events into financial transactions (e.g., journal entries) and supports daily operations.
• Financial Reporting System (FRS): Aggregates daily financial information from the TPS and other sources to enable timely financial reporting.
• Management Reporting System (MRS): Provides internal financial information to solve daily business problems, such as for budgeting and variance analysis.

Accounting Information System (AIS) Audit Trail

The traceable path linking source documents to financial statements and vice versa:

Automated 3-Way Match Verification

Automated AIS Control: System blocks invoice payment disbursement unless all three documents match within predefined tolerance thresholds.

Automated Application Input Validation Controls

Application-level input controls ensure data entered into the system is complete, accurate, and valid before processing.

Automated Application Input Controls

Batch Processing Controls & Data Totals

IT Audit Testing & CAATs Framework

Computer-Assisted Audit Techniques (CAATs) enable auditors to evaluate automated controls, test application program logic, and analyze electronic populations.

Five Core CAATs Methodologies

IT Audit Sampling & Data Analytics

Emerging Tech & Blockchain

Technologies for Process Improvement

• Robotic Process Automation (RPA): The use of software programs ("bots") capable of extracting information from a user interface and initiating further processes, designed to automate repetitive, rules-based tasks.
• Blockchain: A decentralized, distributed ledger that records transactions into immutable (unchangeable) blocks, ensuring strong record integrity.
  
  The COSO Internal Control Framework can be applied to blockchain by assessing risks in the IT environment (e.g., smart contract flaws, consensus mechanism vulnerabilities) and implementing specific control activities, like strict private key management and logical access controls, to ensure the reliability of financial reporting.

BPaaS, AI Architecture, NLP & IoT Controls

Business Process as a Service (BPaaS):

• Delivery of an end-to-end business process (e.g., complete payroll operations, travel & expense management) via automated cloud services.
• Distinction: SaaS delivers software tools; BPO delivers outsourced human labor; BPaaS delivers fully automated, standardized cloud-native workflows.

3-Layer Artificial Intelligence (AI) Architecture:

1. Infrastructure Layer: Cloud compute, GPUs, TPUs, distributed high-speed storage arrays.
2. Model Layer: Base foundational algorithms, LLMs, neural networks, machine learning models.
3. Application Layer: End-user software interfaces (e.g., AI document scanners, conversational fraud bots).

Natural Language Processing (NLP) in Accounting:

• Extracts unstructured text from lease agreements for ASC 842 / IFRS 16 compliance.
• Performs automated sentiment analysis on customer emails and reviews for warranty provisions.
• Automates contract analysis during M&A due diligence to flag hidden covenants.

RPA Bot Lifecycle Governance & IoT Risk:

• RPA Governance: Requires formal bot credential vaults, Segregation of Duties (developers cannot run production bots), and independent bot activity logging.
• Internet of Things (IoT) Controls: Enforce zero default passwords, network micro-segmentation into dedicated IoT VLANs, and automated firmware patch cycles to prevent botnet inclusion.