Key takeaways
- Plan audits and tests so they don't disrupt operational systems.
- Audits themselves can disrupt systems if not planned.
- Start here: agree audit scope and access with system owners.
Purpose
Plan audits and tests so they don't disrupt operational systems.
Requirement
Requirement summaryAudit tests and other assurance activities involving assessment of operational systems shall be planned and agreed between the tester and appropriate management.
Why it matters
Audits themselves can disrupt systems if not planned.
How to implement
- Agree audit scope and access with system owners.
- Use read-only access where possible.
- Schedule tests to minimise disruption.
- Monitor and log auditor activity.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.34. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for planning audits and technical tests on live systems so they don't cause disruption.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.34 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Plans and approvals for recent audits or technical tests.
- Records of when tests ran and who ran them.
- Notes of any disruption and the follow-up.
Things you should be able to show or explain
- IT should be able to explain how testing impact is kept low.
How much to show: The most recent test.
Common mistakes
- Tests run with no plan.
- Testing caused an outage.
- Auditors given admin access without oversight.
- Tests run during peak hours.
- Tip: Agree scope and timing of technical audits in advance.
Policies & documents to have
- Internal audit procedure
- Operations Security Policy
- Risk Management Policy
FAQ
Is A.8.34 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.34?
Be ready to explain how the control works in your organisation and to provide things like: Your process for planning audits and technical tests on live systems so they don't cause disruption…