Ensuring Secure Information Systems During Audits: ISO 27002 Control 8.34 Explained
Audit tests play a critical role in detecting and eliminating security risks and vulnerabilities in the information systems.
However, the audit process, whether performed in operational, testing, or development environments, can expose sensitive information to the risks of unauthorised disclosure, or loss of integrity and availability.
Control 8.34 deals with how organisations can maintain the security of information assets during audit tests.
Purpose of Control 8.34
Control 8.34 enables organisations to eliminate and mitigate risks to the security of information systems and to the continuity of business operations by establishing and applying suitable measures and controls such as access restrictions and read-only access limitations.
Attributes Table of Control 8.34
Control 8.34 is preventive in nature as it requires the upper management and the auditor to plan and agree on audit testing procedures, restrictions, and controls prior to carrying out audits.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality | #Protect | #System and Network Security | #Governance and Ecosystem |
| #Integrity | #Information Protection | #Protection | ||
| #Availability |
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Ownership of Control 8.34
The IT management team should be responsible to plan and agree on audit procedures and to create and apply necessary measures.
General Guidance on Compliance
Control 8.34 lists eight specific requirements organisations should consider:
- Appropriate management and the auditor should agree on access to systems and information assets.
- Agreement on the scope of technical audit tests to be performed.
- Organisations can only provide read-only access to information and software. If it is not possible to use the read-only technique, an administrator with necessary access rights can gain access to systems or data on behalf of the auditor.
- If an access request is authorised, organisations should first verify that devices used to access systems meet the security requirements before they provide access.
- Access should only be provided for isolated copies of files extracted from the system. These copies should be permanently deleted once the audit is complete unless there is an obligation to retain those files. If read-only access is possible, this control does not apply.
- Requests by auditors to perform special processing such as deploying audit tools should be agreed upon by the management.
- If an audit runs the risk of impacting system availability, the audit should be carried out outside of business hours to maintain the availability of information.
- Access requests made for audits should be logged for the audit trail.
Supplementary Guidance on Control 8.34
When audits are performed on testing or development environments, organisations should be cautious against the following risks:
- Compromise of the integrity of code.
- Loss of confidentiality of sensitive information.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes and Differences from ISO 27002:2013
27002:2022/8.34 replaces 27002:2013/(12.7.1)
Although the 2022 version is similar to the 2013 version to great extent, there are two key differences.
ISO 27002:2022 Version Introduces a New Requirement
2022 version introduces the following requirement that was not referred to in the 2013 version:
If an access request is authorised, organisations should first verify that devices used to access systems meet the security requirements before they provide access.
2022 Version Addresses Testing and Development Environments
In the Supplementary Guidance, the 2022 version cautions organisations against the security risks due to audits performed on testing and development environments. The 2013 version, on the contrary, did not refer to the testing and development environments.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.
Our platform is intuitive and easy-to-use. It’s not just for highly technical people; it’s for everyone in your organisation. We encourage you to involve staff at all levels of your business in the process of building your ISMS, because that helps you to build a truly sustainable system.
Get in touch today to book a demo.
