Most security leaders look at Internal Audit as performing assessments or investigations and looking for deficiencies with a set due date and time. But today, internal audits are a continuous lifecycle. Internal Audit is constantly evaluating controls – even when it's the off-cycle for audits – to ensure controls are properly designed, operating effectively and the right people are in the right roles to perform the control activities.
A Shift In Relationship Mindset
The relationship between the CISO and Internal Audit can easily be a strained one. Internal Audit can oftentimes be seen as internal affairs at a police station – waiting to catch a slip-up, bringing on a forced discussion and a long list of remedial action items that take away from the day-to-day priorities.
But at Trustwave, CISO David Bishop and Vice President of Internal Audit Mark Domzal have flipped the script and embraced a shift in relationship mindset. That shift has led to a successful partnership with a common goal – protecting critical data and systems with the resources they have available at all costs.
We sat down with David and Mark to discuss how a strong relationship between the Office of the CISO and Internal Audit benefits the security of a company and its customers.
Talk to us about how you see the role of the Office of the CISO and cybersecurity structured – from the perspective of a leader for Internal Audit?
Mark: David and his team are constantly coming up with innovative ideas in an effort to optimize the organization's security posture. Emerging risk never sleeps – and we recognize that the Office of the CISO has to rapidly evolve in order to combat that.
If there are going to be changes made to the organization that will have a security or a fundamental technology impact, we're discussing those as a team to make sure that we're aligned and can keep up with that evolution from the audit side. We're also offering real-time advice from an internal controls and risk management perspective.
When I look at how cybersecurity should be structured, it's a three-layer of defense model. You have the business and cybersecurity solutions themselves as the first line of defense to manage risk and perform the internal controls; then you have the CISO and the information security team as the second line – advising management about proactive security strategies and how controls should be designed and operating. And as the third layer, you have Internal Audit as the independent assessment to ensure all three layers are in sync, effective and up to industry standards.
How does having a strong relationship with Internal Audit benefit the Office of the CISO?
David: With a strong relationship, you're able to get on the same page quicker. For example, if my team identifies a workflow problem, I can give that context to Mark, and we can begin a dialogue on how to solve it.
That joint dialogue is highly valuable in terms of advocating for investment in security – whether that's more people or technology. Audit results and Mark's opinion have been invaluable resources to drive security change within the organization. When we partner to deliver a consistent message about resource needs and how those resources fit into our audit and security strategies, it speeds up the decision processes both operationally as well as at the board level. We can get to deployment and 'securing' a lot quicker.
How does the relationship between Internal Audit and the CISO benefit the customer experience?
Mark: Supply chain risk is something that has really come to life over the past ten years and has reached critical mass with the SolarWinds breach.
When you're sharing information with a vendor, whether it's a third-party data center or a contractor, you're responsible for the risks associated with sharing sensitive data and, in many ways, the vendor that you're sharing critical data with.
Customers want to make sure that the sensitive information they're sharing is being handled correctly, that you have your own house in order, and are proactively managing third-party risks.
David: It's important to constantly communicate with customers about annual audits but also about the 'extra mile' security measures you are putting in place, like real-time monitoring of the security state of each vendor.
Our collective work with Internal Audit to achieve the highest standards possible and then go above and beyond the bar industry audit standards set requires maintaining the Center for Internet Security (CIS) best practices and an awareness that audit and compliance are the starting point, the minimum standard, so to speak.
For example, Trustwave maintains its SOC 2 Type 2, ISO 27001 certification and several other specialty certifications. It is currently pursuing ISO 9000 and 20000 certifications. These achievements are a result of the strong and fluid interaction between the Internal Audit team and the Information Security team. It's another great example of how a strong relationship between the two internal organizations can maintain operational velocity and provide enhanced value for customers.
For more information about technology and implementation offerings from Trustwave Consulting and Professional Services, visit: https://www.trustwave.com/en-us/services/consulting-and-professional-services/