|
Auditing federal IT systems doesn’t have to be chaotic.
In fact, for Gerald Auger, a former cybersecurity auditor for public sector systems, the week-long checklist efforts involved little tension or shock for the auditees. Because everybody knew he was coming.
“I’ve never been part of a surprise audit,” Auger told IT Brew.
Auger, now adjunct faculty at military college The Citadel and CEO of his consulting firm Coastal Information Security Group, used to validate cybersecurity practices of federal systems, as mandated by the Federal Information Security Modernization Act of 2002.
Such audits required Auger and his team to check federal systems and assess the implementation of security controls found and categorized in the playbook NIST 800-53. The former professional services contractor with Booz Allen Hamilton and Honeywell shared with us how he interacted with in-house IT teams to perform the cybersecurity checks.
The cooperative process involves liaisons, dummy accounts, request forms, junior auditors, and few surprises.
Read more here.—BH
|