Internal and External Auditors
Overview
Auditors validate the effective application of the practices described in the SbD-ToE.
They verify risk classifications, traceability, evidence of application, and alignment with regulatory requirements across all chapters.
Key Responsibilities
- Validate the effective application of the prescribed practices
- Assess risk classifications, requirements, traceability and evidence
- Produce independent reports and improvement recommendations
- Do not audit processes, controls or decisions they took part in: the auditor and the audited function are different people
- Attest compliance before the authorities
Organisational Context
They are essential instruments for demonstrating compliance to supervisory authorities, as required by NIS2, DORA, GDPR and ISO 27001.
Regulatory Framework
They are formal instruments for demonstrating compliance to the authorities:
- NIS2: Security and compliance audits
- DORA: Resilience testing and third-party audits
- GDPR: Data protection audits
- ISO 27001/27002: ISMS audits
Activities by Chapter
Cross-cutting - All Chapters
Validate evidence of practice application, verify traceability of decisions (ADR, exceptions, risk acceptances), confirm alignment with regulatory requirements (NIS2, DORA, GDPR, SSDF, ISO 27001).
Associated requirements:
- US-12: Regulatory compliance documentation - GRC / Compliance documents, Auditors validate
Ch. 01 - Application Classification
Verify risk classifications and their adequacy to the technical and business context. Validate governance KPIs.
Associated requirements:
- Classification governance KPIs - GRC / Compliance consolidates, Auditors validate
- Formal organisational policies - Executive Management publishes, Auditors validate application
Ch. 02 - Security Requirements
Validate the implementation of requirements per level (L1/L2/L3), verify traceability requirements → controls → evidence.
Ch. 07 - Secure CI/CD
Validate commit → pipeline → release traceability, verify exception management.
Associated requirements:
- US-09: End-to-end traceability - GRC / Compliance traces, Auditors validate
- US-10: Exception management - GRC / Compliance manages, Auditors validate
Ch. 08 - IaC and Infrastructure
Validate file → resource → environment traceability, verify change windows and approvals, validate formal exceptions.
Associated requirements:
- US-07: File → resource → environment traceability - GRC / Compliance documents, Auditors validate
- US-13: Change window and approvals - GRC / Compliance defines, Auditors validate
- US-14: Formal exceptions in IaC - GRC / Compliance / AppSec Engineer manage, Auditors validate
Ch. 14 - Governance and Contracting
Audit exception documentation, verify formal approvals, validate contractual compliance with suppliers, verify complete traceability.
Associated requirements:
- US-06: Compliance repository - AppSec Engineer / Scrum Master / Team Lead maintain, Auditors validate
- US-07: Periodic compliance validation - AppSec Engineer / GRC / Compliance carry it out, Auditors validate
- US-10: Centralised compliance checklist - AppSec Engineer / Scrum Master / Team Lead maintain, Auditors use
Chapter References
Auditors use every chapter as a source of evidence:
- Ch. 01 - Application Classification
- Ch. 02 - Security Requirements
- Ch. 03 - Threat Modelling
- Ch. 04 - Secure Architecture
- Ch. 05 - Dependencies and SBOM
- Ch. 06 - Secure Development
- Ch. 07 - Secure CI/CD
- Ch. 08 - IaC and Infrastructure
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations
- Ch. 13 - Training and Onboarding
- Ch. 14 - Governance and Contracting