ISO 27001 8.34 Protection of Information Systems During Audit Testing Requirement:
"Audit tests and other assurance activities involving assessment of operational systems shall be planned and agreed between the tester and appropriate management."[1]
ISO 27001 8.34 Protection of Information Systems During Audit Testing Requirement Explanation:
Before the IT or security team performs an information security audit (internal or external) on the organization it must receive approval from executive management. It should also ensure that the audit does not damage the information system or its data. For example a penetration test should not affect the availability of the system delete or lock the organization's data.
References:
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.