Information Security Management Handbook, Volume 6, 6th Edition

Chapter 4

The Information Security Auditors Have Arrived, Now What?

Todd Fitzgerald

Introduction

Auditors perform an essential role in protecting the information assets of an organization, which should be embraced rather than feared. Many times, when an audit is scheduled, whether internally or externally initiated, the response is one of fear of what the auditors will find as gaps in the information security program. Analogous to how many people feel when they are scheduled for their annual performance review, anxiety is almost certain to be a normal ...