Organization should conduct internal information security audits
High
Cross-cloud
General
manual-iso-internal-audit
How to fix it
Conduct internal audits at planned intervals to verify that the information security management system conforms to requirements and is effectively implemented. Report findings to management.
How to verify
- Verify audit schedule and most recent audit report
- Confirm management review of audit findings
- Verify corrective actions from audit findings are tracked
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Cross-cloud rules
- Block storage volumes must be encrypted
- Cache service security hardening
- Cache services must enforce TLS encryption in transit
- Container registry security hardening
- Database authentication must use managed identities
- Databases must not be publicly accessible
- IAM password policy must require minimum length of 14
- Key management service security hardening