In the first part of this series, we explored the concept behind the IIA’s Cybersecurity Topical Requirement—its purpose, structure, and the 17 minimum requirements that set the baseline for assurance engagements. In this second part, we shift from theory to practice, offering a step‑by‑step guide on how internal auditors can apply the requirement in real audits. From planning and mapping existing frameworks to testing controls and documenting exclusions, this section provides practical tools to help Chief Audit Executives and audit teams embed cybersecurity assurance into their work with confidence and consistency.
1. A Six-Step Approach
- Check the audit plan: During annual planning, see whether cybersecurity is covered and in which audits (Standard 9.4).
- Map what is already tested: If existing audit programmes follow NIST or COBIT, use the mapping in Section 4 to see which requirements they already cover.
- Go through all 17 requirements at the planning stage: Mark each one “in scope” or “excluded”, and record the reason for every exclusion using the checklist in Section 5.
- Look for cyber risk in every audit: During walkthroughs of non-IT processes such as payments or payroll, ask how systems and data are protected. If a cyber risk shows up, go back to step 3.
- Check skills before fieldwork: If the team lacks technical knowledge, arrange training or a specialist in time.
- Test, report and keep the evidence: File the completed checklist with the workpapers, ready for quality review.
2. What to Review Under Each Pillar
The IIA’s “Considerations” are examples, not a tick-box list.
Governance: Is the board overseeing cybersecurity?
- A written cybersecurity strategy that supports business goals, with clear KPIs.
- Regular (generally quarterly) board updates from the Chief Information Security Officer (CISO).
- Enough budget and staff to meet security goals.
- Policies reviewed at least annually, or sooner when new risks appear.
- Clear roles, a sufficiently senior security head, and key departments and vendors kept informed.
Risk Management: Does the organisation see all its cyber threats?
- Input from all departments into the cyber risk assessment. Leaving out supply chain or accounts and finance is a common blind spot.
- A named owner for cyber risk who reports regularly.
- Defined risk levels with a quick escalation route, considering reputational as well as financial impact.
- Annual staff awareness training, for example through mock phishing emails.
- A written incident response plan, rehearsed at least annually through a tabletop exercise (a desk-based mock drill), with results reported to senior management.
Control Processes: Are the day-to-day defences working?
- Asset management from purchase to disposal; old devices not wiped properly are a common source of data leaks.
- Encryption of stored and transmitted data, multi-factor authentication (MFA), user access reviews and timely patches.
- Network segmentation, firewalls, secure remote access (VPN or zero trust network access) and intrusion detection.
- Vendor SOC reports reviewed before onboarding and during the contract.
- Trained security staff and a process to assess new threats, including artificial intelligence.
3. Applying It in Three Situations
| Situation | What internal audit must do |
| Cybersecurity is in the audit plan | Apply the requirement in those audits; it can be spread across more than one audit. Record why any requirement is not relevant, e.g., covered in another year’s rotation. |
| Cyber risk found in a non-cyber audit (e.g., a web portal for purchase orders in an accounts payable audit; Standard 13.2) | Decide which parts apply; cyber governance, for instance, may not be relevant. Record the reasons in the workpapers. |
| Unplanned request from the board, management or a regulator, e.g., after a cyber attack | The requirement applies in full. Go through every requirement and record the reason for any left out. |
4. Mapping to US National Institute of Standards and Technology (NIST) and Control Objectives for Information and Related Technologies (COBIT)
CAEs are expected to check whether the existing programme tests the references mentioned in the control families of NIST and control objectives mentioned in COBIT. The references are classified under three pillars of Governance, Risk Management and Control Processes.
The IIA guide gives requirement-wise references; confirm them against the current version of the framework in use.
5. Documentation Checklist
The IIA’s form is optional; the same record can sit in the audit plan or workpapers.
| Ref. | Requirement | Coverage / reason for exclusion |
| G-A | Cybersecurity strategy, with board updates on progress, budget and resources | |
| G-B | Policies and procedures kept up to date | |
| G-C | Clear roles; skills reviewed periodically | |
| G-D | Stakeholders discuss and act on weaknesses and new threats | |
| R-A | Threats identified, assessed, reduced and tracked | |
| R-B | Cyber risk managed organisation-wide, not just IT | |
| R-C | Named risk owner reporting regularly | |
| R-D | Unacceptable risks escalated quickly | |
| R-E | Staff awareness; management reviews and fixes gaps | |
| R-F | Incident response and recovery plan, tested periodically | |
| C-A | In-house and vendor controls protect systems and data; evaluated periodically | |
| C-B | Cybersecurity staff recruited, trained and kept current | |
| C-C | Continuous monitoring of emerging threats | |
| C-D | Security across the IT asset life cycle | |
| C-E | Secure configuration, device management, encryption, patching, access, secure development | |
| C-F | Network controls: segmentation, firewalls, VPN/ZTNA, IoT, IDS/IPS | |
| C-G | Communication tools secured: email, browsers, messaging, cloud, file sharing |
6. Key Actions for the CAE
- Build it into the Quality Assurance and Improvement Programme (Standard 8.3) now.
- Fill skill gaps, but keep ownership of the results.
- Test in line with risk: the requirement is the minimum; go deeper where cyber risk is high.
Applied well, the requirement helps internal audit give the board clear and reliable assurance on one of the biggest risks the organisation faces.
Together, these two articles provide a complete roadmap for understanding and applying the IIA’s Cybersecurity Topical Requirement. Part 1 laid the foundation by explaining the concept, its place within the Global Internal Audit Standards, and the 17 minimum requirements across governance, risk management, and control processes. Part 2 built on that framework, offering a practical six‑step approach, detailed review points under each pillar, and guidance on mapping to existing frameworks like NIST and COBIT. Taken as a whole, the series equips Chief Audit Executives and internal audit teams with both the theory and the tools to deliver consistent, reliable assurance on one of the most critical risks organisations face today.
About the Author
Apoorv Mathur is a seasoned Risk Consulting and Business Advisory professional with years of experience in Internal Audit, Enterprise Risk Management, Corporate Governance, and Compliance Advisory. He is a Partner at AMP & Co., Chartered Accountants, and Promoter of Compezz Solutions Pvt. Ltd., a RegTech company specialising in compliance automation.
He currently serves on the Board of Governors of IIA Delhi Branch and is the President of IIA Jaipur Audit Club.
Source: The Institute of Internal Auditors, Cybersecurity Topical Requirement User Guide (2025).