Information Security Program Review

The Information Security Program review provides a review of your organization’s written policies, procedures, and established IS practices. This controls-oriented review is designed to assess operational IT areas for compliance with outstanding regulatory guidance, organizational policies, and industry best practices.

In contrast to what we describe as a ‘technical’ review, the control review focuses on more traditional internal control concepts that mirrors what most forms of internal or external audit would generally cover; however, this review scope has been developed with specific reference to controls over technology systems and information assets. For financial institution clients, this review is generally structured to simulate, to the extent possible, an examination conducted using the Federal Financial Institutions Examination Council (FFIEC) interagency work papers contained in the published series of IT Booklets.