Information Security Controls, Audit, and Compliance
Domain 2 (Information Security Controls, Audit, and Compliance) tests control selection and the assurance cycle: how a control is designed, evidenced, tested, and how findings are driven to closure. Expect questions on control taxonomy, framework reuse, and the language of third-party assurance reports.
Control taxonomy
- By function: preventive, detective, corrective, deterrent, compensating, and directive. A control can be more than one; the exam usually asks what role it plays in a given scenario.
- By nature: administrative (policies, background checks), technical or logical (encryption, MFA), physical (locks, badge readers).
- Defense in depth layers controls so that no single failure is decisive.
Frameworks you must be able to distinguish
- ISO/IEC 27001 specifies ISMS requirements; ISO/IEC 27002 gives implementation guidance for the Annex A control set. Certification runs Stage 1 (documentation and readiness) and Stage 2 (implementation evidence), followed by surveillance audits and recertification on a three-year cycle.
- NIST SP 800-53 is a control catalog; the NIST Cybersecurity Framework organizes outcomes into Govern, Identify, Protect, Detect, Respond, and Recover; CIS Controls give prioritized safeguards; COBIT addresses governance.
- Pick one master framework, map the rest to it, and keep a control-to-requirement matrix as audit evidence.
Audit mechanics
- Evidence comes from inspection, interview, observation, sampling, and re-performance.
- Design effectiveness asks whether the control could achieve its objective; operating effectiveness asks whether it actually ran throughout the audit period. A well-designed control that was skipped for two months is an operating failure.
- Findings produce a corrective action plan with owner, due date, and re-test. Major and minor nonconformities carry different escalation paths.
Worked example
An auditor samples 30 of 400 terminated employees over twelve months. Four accounts remained active more than 30 days after termination. The termination workflow exists and is documented, so design is effective; the failure is in operation. Root cause is a manual HR-to-directory handoff, so the corrective action replaces it with an automated feed, adds a monthly reconciliation, and sets a re-test in 30 days. The report describes an operating deficiency, not a design gap, and the control owner sits in HR operations.
Traps that cost marks
- Treating a SOC 2 Type I report (design at a point in time) as evidence of operation across the year; only Type II covers a period.
- Accepting a compensating control without documented equivalence and management approval.
- Claiming zero exceptions from a sample proves zero errors; sampling gives reasonable assurance only.
- Allowing the function being audited to set audit scope or approve its own finding closures.