Call us now:
Cybersecurity risk management has been a continual challenge for the Internal Audit Community. I have presented many times over the past 2 years on the challenges internal audit face with cybersecurity, cybersecurity risk management and cyber regulation for the The Institute of Internal Auditors Inc.
‘Cybersecurity remains a threat with risk and internal audit effort well-balanced (84% and 79% respectively).’ and this is before one accounts for the challenges in regulatory oversight, assurance and attestation, required by internal audit and Chief Audit Officers. EU cyber regulation NIS 2, DORA and the U.S SEC final cyber rule create significant challenges for the 3 Lines of Defense, defining opportunities and threats for internal audit in 2024 and beyond.
Internal Audit as the 3rd Line of Defense will be called upon to provide assurance to covered organizations, and manage the relationship between external audit. For example Article 32 of NIS 2 sets out requirements for the 27 EU member states to conduct supervisory oversight that includes targeted security audits conducted by trained individuals, on and off site inspections, ad hoc audits and request for information of cyber polices (amongst other things). Audit and information that should be attested by internal audit prior to any external evaluation. The SEC final cyber rule requires covered entities to identify board committees, subcommittees and individuals that oversight, assure and attest cyber, that will likely include the Chief Audit Officer.
Ted Dziekanowski Brian D. McCarthy Bob Dix Rachel V. Rose, JD, MBA
#paravasecuritysolutions #cybersecurity #internalaudit #cyberriskmanagement
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7122635173141041153