What evidence do auditors commonly ask for on 8.34 Protection of information systems during audit testing?

Management approvals of auditor access requests and agreed scopes for technical audit tests; Evidence that auditor access was read-only, or that tests were run by an authorized administrator on the auditor's behalf; Security checks of auditor devices (patching, anti-malware) before access was granted; Records of isolated file copies provided for audit and their deletion or protection afterwards; Schedules showing availability-affecting tests run outside business hours; Logs of all access performed for audit and testing purposes.

What is the most common gap auditors find on 8.34?

External auditors are given full administrative accounts on production systems

ISO/IEC 27002:2022 · Technological controls

`8.34` Protection of information systems during audit testing

Audit tests and other assurance activities that assess operational systems need a plan agreed in advance by whoever tests and the relevant managers. Purpose: keep the effect of audits and other assurance work on operational systems and business processes as small as possible. Guidance: get the relevant managers to agree what systems and data auditors may reach; agree and control the scope of technical audit tests; keep audit tests to read-only use of software and data, and where read-only access cannot obtain the needed information, have an experienced administrator with the required rights run the test for the auditor; if access is granted, set and check the security requirements, such as anti-virus and patching, of the laptops or tablets used before allowing access; allow wider access only to separate copies of system files, removing those copies after the audit or protecting them appropriately if audit documentation rules require keeping them; identify and agree requests for special or extra processing such as running audit tools; run tests that could affect availability outside business hours; and monitor and record every access made for audits or tests. Audits and assurance tests on development and test systems can also affect code integrity or expose sensitive information held there.

Source: ISO/IEC 27002:2022, 8.34. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

hard

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Logs of all access performed for audit and testing purposes · Identity provider / directory

periodic reviewEvidence produced at each review

Management approvals of auditor access requests and agreed scopes for technical audit tests · Identity provider / directory
Evidence that auditor access was read-only, or that tests were run by an authorized administrator on the auditor's behalf · Identity provider / directory
Security checks of auditor devices (patching, anti-malware) before access was granted · Vulnerability scanner / patch tooling
Records of isolated file copies provided for audit and their deletion or protection afterwards · Identity provider / directory

governing documentDocuments that govern the control

Schedules showing availability-affecting tests run outside business hours · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

External auditors are given full administrative accounts on production systems
Audit tools are run in production during peak business hours without agreement
Auditor laptops connect to internal networks without any security check
Audit accounts remain active after the audit ends

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

8.33 Test information