Skip to content

Information Security Governance Audit

Your policies are written, your risk assessment is done, and your vendors are on file. But is your program holding up, and would it stand up to an examiner or auditor? An ISGA gives you an independent answer without the cost of a full technical audit.

SEC-InformationSecurityGovernanceAudit

Independent Review, Stronger Oversight

The audit looks at how your information security program is run: your policies, risk assessment, vendor oversight, business continuity planning, training, and how leadership stays involved. We compare what’s documented against what’s expected and show you where the gaps are.

You get clear priorities, not a pile of findings. We point out what needs attention first, so your team can fix the issues that matter before an exam or outside audit finds them. The review is done remotely, so there’s little disruption to your staff. If you want technical testing as well, the IT Audit and Vulnerability Assessment covers everything in this audit and more.

Service Features

An Information Security Governance Audit is a policy and procedure review of your information security program. It does not include technical testing, which makes it a good fit if you already test your technology separately or want to start with governance. Our auditors hold the CISA and CISSP certifications, and we never subcontract the work.

Request More Information Back to IT Audit & Testing Services

  • Review of information security policies, program elements, budgeting, and officer designations

  • Risk assessment review covering design, scope, and how often it’s updated

  • Business continuity plan review, including impact analysis, recovery objectives, communication, alternate site, and testing

  • Vendor management review covering program and policy, risk assessment, due diligence, contract terms, and reporting

  • Review of security awareness training, acceptable use, employee background checks, and officer duties

  • Evaluation of audit independence and how issues are tracked through to resolution

  • Review of how information security is reported to senior management and the Board

  • Performed remotely, with written findings and recommendations