Organizations preparing for ISO 27001 certification
A gap analysis shows what is missing before the certification audit, so preparation is targeted and gaps do not surface during the formal audit.
/ SECURITY AUDITS
Security Audits
Qyntar's independent security audit shows where your information security really stands: which controls work, which exist only on paper, and what it takes to pass an external audit, a customer review or a regulatory inspection.
[ 01 ] / WHAT IT IS
What is an information security audit, and what does it give you?
In short
A security audit is a systematic, independent examination that compares your information security practice with a set of requirements (such as ISO 27001, NIS2 or internal policy) and assesses, on evidence, not just whether controls exist but whether they work. The result is a ranked list of gaps and the actions needed to close them.
An information security audit answers two questions at once: do you comply with a given standard, and does what is written down actually work in practice? They are not the same question. Many organizations have policies that do not reflect how they operate day to day, and many have effective technical controls that are undocumented. The audit makes that gap visible.
The method draws on several kinds of evidence: analysis of documents and policies, interviews with control owners, sample checks of system configuration, review of logs and tickets, and technical tests where needed. The result is therefore not an opinion but a traceable set of findings that an external auditor, a customer or a regulator can rely on.
We distinguish between compliance audits and effectiveness audits. The first checks that a control exists, the second that it genuinely protects. We combine the two where it makes sense, and our controls effectiveness audit covers the latter in depth.
Methodologies and standards
- ISO/IEC 27001:2022
- ISO/IEC 27002
- ISO/IEC 27005
- NIST CSF 2.0
- CIS Controls v8
- NIS2 and the Hungarian Cybersecurity Act
- PCI DSS
[ 02 ] / WHO IT'S FOR
Who benefits from an independent security audit?
Any organization that has to demonstrate its information security, or wants to know how reliable its own defenses are.
Organizations in scope of NIS2 and national cybersecurity law
It is worth verifying, with evidence, that the technical and organizational requirements are met, and closing the gaps on a schedule.
Companies facing a customer or supplier audit
A prior internal or independent audit reduces the chance of surprises and builds confidence with large customers.
New leadership or a new CISO
An independent baseline of how the security function is doing, and where to intervene.
Companies before or after an acquisition
Security due diligence: learning the target's risks, or assessing the starting point before integration after the deal.
Executives who want certainty
Expectations of management accountability are rising. An independent audit is a credible basis for decisions and risk acceptance.
[ 03 ] / WHAT'S INCLUDED
What a security audit covers
We tailor the content to the goal: an ISO 27001 gap analysis calls for different emphasis from a supplier or technical audit.
01
Scope and framework definition
Together we decide which business units, systems and processes the audit covers, and which standard or regulation is the yardstick.
02
Document and policy analysis
Review of information security policies, procedures, risk management documents and roles, for currency, coverage and practical usability.
03
Interviews and process review
Conversations with managers, operations staff, developers and key owners: do the processes really work as the policy says?
04
Sample testing of controls
Checking technical configuration, permissions, logs, patching records, backups and incident tickets, and collecting evidence.
05
Risk management review
Review of the risk assessment methodology, the risk register and treatment decisions against ISO 27005.
06
Supplier and third-party review
Review of risk management for critical suppliers, contractual security requirements and oversight practice.
07
Compliance gap analysis
Comparing the requirements with the actual state: what is met, what is partly met, what is missing, control by control.
08
Report and scheduled action plan
Findings with risk ratings, remediation advice, owners and timing, plus an executive summary and closing session.
[ 04 ] / HOW IT WORKS
How a security audit runs
The process is transparent and plannable: you always know what information and involvement we need, and when.
Preparation and planning
We fix the audit's goal, scope and criteria, draw up the audit plan, name contacts and request the necessary documents.
Document analysis
We review the policies, procedures, records and earlier audit reports you provide against the requirements.
On-site or remote examination
Interviews, observation and sample technical checks in your systems, with the evidence documented.
Evaluation and rating
We weigh findings by risk (critical, significant, medium, low) and identify root causes.
Reporting and closing session
We deliver an executive summary, detailed findings and recommendations, then discuss priorities with you together.
Follow-up
On request, we verify fixes, confirm that gaps are closed, or support your final preparation before the formal certification audit.
[ 05 ] / WHAT IT SOLVES
What a security audit solves
An audit removes uncertainty: leadership and the security team get a credible, independent picture of what works and what does not. The gaps it uncovers become the basis for a concrete action plan with owners and deadlines.
It is also evidence for outsiders. To customers, partners, certification bodies and regulators it shows that you manage information security deliberately.
- an independent, credible view of your security posture
- lower risk at the certification or regulatory audit
- separating controls that exist on paper from those that actually work
- a risk-prioritized action plan with named owners
- a firmer basis for executive decisions and budget justification
What you receive
- an executive summary and risk map
- detailed findings with evidence
- a requirements compliance matrix (gap analysis)
- an action plan rated by risk
- a closing session with leadership
- follow-up until gaps are closed
[ 06 ] / WHY QYNTAR
Why have Qyntar run your audit?
Because our audits are neither paper factories nor formalities without technical depth. We can do both at once.
Technical grounding
We check that controls work in practice, with technical evidence, not only from documents. Our attacker experience helps here.
Executive experience
We have real CISO experience from a regulated sector behind us, so we know the budget, regulatory and operational constraints within which recommendations must be implemented.
Proportionate recommendations
Our recommendations are sized to your actual exposure. We focus on meaningful risk reduction rather than over-engineered, box-ticking solutions.
An audit-readiness mindset
We do not just list faults. We help organize evidence and prepare you for the formal audit.
[ 07 ] / FAQ
Frequently asked questions: Security Audits
What is the difference between an internal and an independent external audit?
An internal audit is carried out by your own staff or a designated internal team, who are often involved in the processes under review. An independent external audit is more objective, draws on wider experience, and carries more weight with customers, partners and certifiers.
How long does a security audit take?
It depends on scope and organization size. A focused gap analysis takes a few weeks, while a full, multi-area audit can take 1 to 3 months. We fix the exact schedule in the planning phase.
Is Qyntar a certification body?
No. Qyntar performs independent advisory and verification (pre-certification, readiness) audits that support your preparation for formal certification. Official ISO 27001 certification is issued by an accredited certification body.
Does the audit help with NIS2 and national cybersecurity law?
Yes. The audit shows which of the regulation's technical and organizational expectations you meet and which are missing. See NIS2 compliance for more.
What do we need to prepare before the audit?
Your existing policies, procedures, risk management documents, organization chart, system inventory and previous audit reports. We provide the exact list at the start of the planning phase.
Can the audit be combined with technical testing?
Yes, and in many cases that is recommended. The audit examines processes and controls, and a penetration test shows real exploitability. Together they give the full picture.
What happens after the audit?
We hand over the report and action plan, and support implementation of the fixes as needed. A follow-up check confirms the gaps are closed, or we help you prepare for the formal certification audit.
[ 08 ] / RELATED SERVICES
You may also be interested in
[ + ] / CONTACT
Contact
E-mail
Tell us about your security challenge.
From a specific technical issue to a complex security project, we can help you find the way forward.
Show email address
info
qyntar
com