## 8.34 Protection of information systems during audit testing

| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| --- | --- | --- | --- | --- |
| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #System_and_network_security #Information_protection | #Governance_and_Ecosystem #Protection |

**Control**
Audit tests and other assurance activities involving assessment of operational systems should be planned and agreed between the tester and appropriate management.

**Purpose**
To minimize the impact of audit and other assurance activities on operational systems and business processes.

**Guidance**
The following guidelines should be observed:

a\) agreeing audit requests for access to systems and data with appropriate management;

b\) agreeing and controlling the scope of technical audit tests;

c\) limiting audit tests to read-only access to software and data. If read-only access is not available to obtain the necessary information, executing the test by an experienced administrator who has the necessary access rights on behalf of the auditor;

d\) if access is granted, establishing and verifying the security requirements (e.g. antivirus and patching) of the devices used for accessing the systems (e.g. laptops or tablets) before allowing the access;

e\) only allowing access other than read-only for isolated copies of system files, deleting them when the audit is completed, or giving them appropriate protection if there is an obligation to keep such files under audit documentation requirements;

f\) identifying and agreeing on requests for special or additional processing, such as running audit tools;

g\) running audit tests that can affect system availability outside business hours;

h\) monitoring and logging all access for audit and test purposes. 

**Other information**
Audit tests and other assurance activities can also happen on development and test systems, where such tests can impact for example the integrity of code or lead to disclosure of any sensitive information held in such environments.