Security Audit

Define scope

Define functional categories

Define level of detail of audit

Prepare audit execution plan

Perform checks for each functional (sub)category according to NIST Framework

Review documentation

Conduct interviews with key stake holders

Report on each functional (sub)category

Define Target Profile

List corrective actions addressing key flaws and risks (roadmap)

Present audit report to stakeholders

Explain corrective actions to increase maturity towards next audit