Skip links

Cybersecurity Audit

Assessment of controls, risks and compliance, with prioritized recommendations for improving the security of the organization

Navighează la

Safetech Innovations audit and evaluation services provide a documented picture of security measures, risks and differences from the requirements applicable to the organization. We analyze processes, controls and records in the agreed area and make recommendations for remediation and improvement.

Projects can target compliance requirements, infrastructure and operations security, continuity capacity or digital maturity. For each assessment, we establish the objectives, criteria, period analyzed and deliverables, depending on the activity and needs of the beneficiary.

Utility and benefits

Our audit and evaluation services contribute to:

Identifying weaknesses

Highlighting weaknesses in controls, configurations and security processes

Verification of compliance requirements

Comparison of the measures implemented with the requirements and standards relevant to the field assessed

Prioritizing remediation

Ordering findings and recommendations based on risk and impact on the organization

Supporting management decisions

Technical and executive reports explaining results and priorities for improvement

Organization of records

Documentation of verifications and findings for their use in relation to management, partners or authorities, as appropriate

Tracking progress

A basis of comparison for re-assessments and for checking the progress of security measures

Service characteristics

You can select from our catalog a general assessment or service dedicated to an area, system or set of requirements. Our offer is organised into three areas: compliance, general and maturity assessments, and technical and operational controls.

Audit and conformity assessments

We conduct a complete audit of compliance with NIS2 requirements, within the scope defined for the project. We analyze the entities, processes, security measures and records included, document differences from requirements and propose prioritized remedial measures for management and responsible teams.

Deliverables: NIS2 audit report, detailed gap analysis, prioritized remediation plan, and executive report to management.

Collaboration model: project with annual planning, according to the agreed schedule. The audit, the evaluation of NIS2 and the support for the implementation of the measures have distinctly set objectives and deliverables.

We conduct an independent, evidence-based assessment of compliance with NIS2 requirements and the applicable framework. The assessment aims to prepare the organisation for compliance, with a narrower scope than the full audit. The analysis covers governance, risks, security measures, incident management and continuity, within the established scope.

Deliverables: NIS2 assessment report, requirements and records matrix, gap analysis and prioritized compliance plan.

Collaboration model: project with defined entities, processes and evaluation period. Checks and conclusions are based on the analyzed evidence; the online indicative questionnaires have a separate information role.

We assess the DORA requirements relevant to financial entities and the agreed domain, including digital operational resilience, information and communication technology (ICT) risk management, and incident reporting. The findings support the identification of measures needed to improve the processes and controls assessed.

Deliverables: DORA audit report, digital resilience assessment, ICT risk management gap analysis and remediation plan.

Collaboration model: project with annual planning. Any threat-based penetration testing activities — TLPT — their scale and frequency are explicitly defined in the project area.

We evaluate the systems and processes included in relation to the NBR, ASF or ADR requirements applicable to the agreed field. The analysis and the documentation delivered follow the requirements, reference versions and period established at the initiation of the project.

Deliverables: audit report, gap analysis, remediation plan and records file for the relevant authority.

Collaboration model: annual recurring service, with entities, systems and requirements defined for each assessment.

We assess IT systems, processes and controls against EBA requirements and guidelines relevant to the agreed field. We correlate the requirements with the measures implemented and document the differences and the necessary actions.

Deliverables: EBA assessment report, requirements and controls matrix, gap analysis and remediation plan.

Collaboration model: annual recurring project or evaluation, with defined systems, processes and analysis period.

We assess the security measures and controls related to electronic payment instruments with remote access, against the references applicable to the project. The analysis tracks the instruments, payment channels and technical and functional controls included.

Deliverables: OMCSI audit report, control matrix, gap analysis, remediation plan and records file.

Collaboration model: project or annual recurring evaluation. Applicable references and verification limits are confirmed when defining the domain.

We evaluate from a technical and security perspective the systems and controls relevant to ReGIS/SaFIR. We document the requirements included, the results of the checks and the measures necessary to remedy the identified differences.

Deliverables: ReGIS/SaFIR audit report, requirements matrix, gap analysis, remediation plan and records file for the authority.

Collaboration model: annual recurring project or evaluation, with defined systems, components and requirements.

We assess the technical and security controls relevant to participation in and operation in SENT. The analysis covers the agreed systems, controls and requirements, with documentation of results and recommendations.

Deliverables: SENT audit report, technical controls matrix, gap analysis, remediation plan and record file.

Collaboration model: project or annual recurring evaluation, within the limits and period established with the beneficiary.

We assess the relevant security systems, processes and controls for access to and exchange of information with ANAF. The checks follow the data flows and requirements included in the area of the assessment.

Deliverables: ANAF audit report, requirements matrix, gap analysis, remediation plan and records file for the authority.

Collaboration model: recurring project or service, depending on the systems and flows evaluated.

We assess the controls in the SWIFT Customer Security Programme against the Customer Security Controls Framework — CSCF — and the agreed period. We identify the differences and document the measures necessary for remediation.

Deliverables: SWIFT CSP assessment report, analysis of differences from CSCF controls, remediation plan and attestation in the agreed area and form.

Collaboration model: annual recurring service. The version of the framework, the level of verifications, the records and the form of the attestation are established when defining the project.

We evaluate electronic archiving solutions and processes from the perspective of integrity, authenticity, retention and access. The analysis follows the systems, archiving periods and agreed criteria.

Deliverables: report on the compliance of the electronic archive, analysis of differences from the included eIDAS requirements, remediation plan and records file for the authority.

Collaboration model: recurring project or evaluation, with defined scope and verification limits.

We evaluate the solutions and processes regarding electronic identification, signatures and trust services, against the selected eIDAS requirements and ETSI standards. The findings document the measures implemented and the differences from the evaluation criteria.

Deliverables: eIDAS audit report, requirements matrix, gap analysis, remediation plan and records file.

Collaboration model: project or recurring evaluation. The legal and technical framework, processes and depth of verifications are established for each project.

We evaluate the design and operational effectiveness of controls against the SOC 2 Trust Services Criteria, for a defined period. The results support the organization's preparation for formal audit and the identification of necessary measures.

Deliverables: SOC 2 preparation and evaluation report, Trust Services Criteria matrix, gap analysis, remediation plan, and records file.

Collaboration model: project or annual recurring evaluation. The deliverable is a preparation and evaluation report, distinct from the formal SOC 2 attestation report.

We evaluate security controls and practices against the requirements and level of the selected CMMC. We analyze the included systems and records and document differences and remedial measures.

Deliverables: CMMC evaluation report, practice and evidence matrix, gap analysis, POA&M remediation plan and executive summary.

Collaboration model: project with CMMC level, defined systems and controls. The assessment supports the readiness of the organization; the issuance of a certification is not included in this service.

We evaluate the technical and organizational controls of the remote video identification processes. The verifications follow the systems, processes and baseline requirements established for the project.

Deliverables: audit report, control matrix, gap analysis, remediation plan, and records file.

Collaboration model: Recurring project or evaluation, with defined object and verification limits.

We evaluate the implementation of the information security management system in relation to ISO/IEC 27001. We identify non-conformities and observations and document remedial measures. Preparation for certification can be included according to the project objectives.

Deliverables: ISO/IEC 27001 assessment report, Annex A control matrix, non-conformities and observations, remediation plan and certification readiness assessment.

Collaboration model: project or annual recurring evaluation. We establish the version of the standard and the perimeter of the evaluated system. The issuance of the ISO/IEC 27001 certificate is a distinct process.

We assess the technical and functional compliance of projects with the approved documentation and funding requirements. The analysis follows the agreed projects, documents and criteria, with the identification of differences and remedial measures.

Deliverables: report on the requirements of the funded project, analysis of differences, remediation plan and record file for the funder.

Collaboration model: project or recurring evaluation. The scope of the service is technical and functional, with limits set for each project.

General and maturity assessments

We evaluate existing security controls and capabilities against a selected NIST or COBIT framework. The results highlight the status of the areas analyzed, the differences, and the priorities for improvement.

Deliverables: evaluation report, domain scores, gap analysis, improvement plan, and executive summary.

Collaboration model: project with defined references, evaluation criteria and scope. The evaluation of controls has distinct objectives from the analysis of the overall maturity of the security program or digital maturity.

We conduct an independent assessment of measures and controls in the IT environment, tailored to the organization's infrastructure and objectives. The analysis can cover the network, endpoints, access, vulnerabilities, logging, backup and incident response.

Deliverables: IT audit report, inventory of findings, risk classification, prioritized remediation plan, and executive summary.

Collaboration model: project with defined assets, locations, period and verification methods. The field is established according to the objectives of the evaluation, without conditioning a certain standard.

We assess the level of digital maturity and security of the organization based on the agreed DMA methodology. The results support the understanding of the current situation and the setting of development priorities.

Deliverables: Digital Maturity Report, Size Scores, Maturity Plan, and Executive Report.

Collaboration model: project with defined methodology and scope. DMA is distinguished from the evaluation of NIST/COBIT controls and from the cybersecurity program maturity assessment.

Audits of technical and operational controls

We evaluate the controls of the included cloud environments: configurations, identities and access, multi-factor authentication, segmentation, encryption, logging, and backup. We document non-compliant configurations and remediation priorities.

Deliverables: Cloud audit report, inventory of non-compliant configurations, analysis of differences in identities, access and logging, prioritized remediation plan and executive summary.

Collaboration model: Project with defined platforms, accounts, and services. The Cloud Security Assessment technical assessment is available separately through security testing services.

We assess the security of network infrastructure, including firewalls, segmentation, VPN, remote access, and internet exposure. Checks track configurations and controls of included assets and locations.

Deliverables: Network audit report, configuration and segmentation analysis, exposure inventory, and prioritized remediation plan.

Collaboration model: project with defined in-depth checks. Penetration tests and recurring administration of network solutions are contracted separately.

We evaluate identity and access management (IAM) and privileged access (PAM) controls, including multi-factor authentication and account creation, modification, and deactivation processes. We analyze access roles and rights in included systems.

Deliverables: IAM/PAM audit report, role and privilege matrix, authentication and identity lifecycle gap analysis, and remediation plan.

Collaboration model: project with defined systems, processes, and evaluation boundaries.

We evaluate monitoring, detection, log coverage, SIEM, alerting, and incident response processes. The analysis tracks detection scenarios and gaps that may affect the operational capacity of the security operations center — SOC.

Deliverables: SOC assessment report, analysis of detection scenarios and log coverage, differences in detection and response, and maturation plan.

Collaboration model: project with defined systems and processes. Recurring SOC/MDR operation is a separate service.

We evaluate the processes for identifying, prioritizing, remediating, and monitoring vulnerabilities and security updates. We analyze remediation deadlines, backlog, and a sample of validated vulnerabilities.

Deliverables: report on processes, analysis of SLAs and outstanding actions, sample of validated vulnerabilities and improvement plan.

Collaboration model: project with defined assets, teams, and sample. Process auditing is distinguished from technical scanning and recurring vulnerability management.

We assess existing continuity and recovery capacity, including BCP/DR plans, backup, and recovery time and point objectives — RTO/RPO. The checks document the consistency between business needs and existing measures.

Deliverables: BCP/DR audit report, validation of the business impact assessment — BIA — and RTO/RPO objectives, analysis of differences in backup and recovery, remediation plan and executive summary.

Collaboration model: project or annual recurring evaluation. Recovery testing is included when explicitly provided. The development or update of the BIA and BCP/DR plans is contracted separately.

Methodology, deliverables and audit team

Methodology used for audit and evaluation

We adapt the methodology to the object and criteria of each service. Before the evaluation, we confirm the applicable references, their versions, the organizational and technical field, the period analyzed and the level of verifications.

Depending on the project, the analysis may use agreed documents, operational records, configurations, interviews and samples. The findings are reported to the established criteria, with an explanation of the risks and the formulation of remedial recommendations.

For the relevant evaluations we use frameworks such as ISO/IEC 27001, NIST or COBIT and the specific requirements of the analyzed field. The selection of the framework and methods follows the objectives of the project and the available information.

Internal tools, such as CERTI, can support the organization and mapping of documents to requirements. The analysis of records, the formulation of findings and conclusions belong to the audit team.

Stages of an audit project

  1. Project initiation. We clarify the objectives, scope, reference requirements, responsibilities and conditions of access to information.
  2. Planning of activities. We establish the calendar, the necessary documents, the systems and processes included and the verification methods.
  3. Execution of the assessment. We review the records and carry out the agreed checks, documenting the findings and associated risks.
  4. Preparation of the report. We bring together the results, the differences from the criteria, the risk classification and the remedial recommendations.
  5. Delivery of results. We present the report and explain the findings and priorities of the responsible teams and management.
  6. Closure of the project. We finalize the deliverables and acceptance according to the agreed criteria and clarify any further activities.

Deliverables and scope of assessment

Each service includes the specific deliverables presented in its description. The content of the reports, samples, periodicity and acceptance criteria are established for each project.

The reports correlate the findings with the requirements and controls assessed. Depending on the service, the results are supplemented with requirements and evidence matrices, risk classifications, remediation plans and management summaries.

Implementation of measures, further testing and re-evaluation of fixes are included when provided for in the project scope.

Audit team

The projects are coordinated by a senior auditor, who follows the planning, communication with the beneficiary and the quality of the deliverables. The team brings together risk assessment and control skills, along with technical experience on security infrastructures and processes.

The composition of the team is adapted to the field evaluated. The relationship with the organization’s managers allows the clarification of the evidence and the understanding of the context in which the analyzed measures operate.

What recommends us?

Safetech’s experience includes involvement in more than 100 projects for the security of critical infrastructures, carried out internationally. Working in environments with high security requirements helps us understand the relationship between the requirements, processes and technical controls evaluated.

Safetech specialists hold professional certifications such as CISA and CISSP, which complement the experience of the consulting and evaluation teams. We adapt the composition of the team to the analyzed field and explain the findings and remediation priorities, so that the results can be used by technical and management managers.

Contact us

Similar articles

See all articles
Powered by  GDPR Cookie Compliance (opens in a new tab)
Overview of Privacy

This website uses cookies to provide you with the best user experience. Cookie information is stored in your browser and serves the purpose of recognizing you when you return to our site, as well as assisting our team in understanding which sections of the site you find more interesting and useful. For more information, you can refer to the General Information Note Regarding the processing of personal data.