Cybersecurity Audits And Reviews Must Be Conducted By Independent Parties Outside The Cybersecurity Function (e.g., Internal Audit Function) To Assess The Compliance With The Cybersecurity Controls In The Organization. Audits And Reviews Must Be Conducted Independently, While Ensuring That This Does Not Result In A Conflict Of Interest, As Per The Generally Accepted Auditing Standards (GAAS), And Related Laws And Regulations.