Without established security policies, it can be more difficult
to determine the company’s risk level. In entering an
agreement with vendors, however, establishing security standards is
not sufficient to ensure the protection of customer or proprietary
information. Security audits can be used as an agreed-upon
mechanism for a company to verify that a vendor is providing the
security controls it promised.
Security audits are comprised of methods to evaluate the
security of a company’s information system. These include
on-site visits and interviewing staff, review of access controls
and user practices, and analysis of the network’s
configuration and of information handling procedures. Security
audits are also carried out to determine a company’s
regulatory compliance.
