AutoQ content pack
Cyber Security Review
This review assesses whether the controls that protect the organization's systems, networks and data against cyber threats are designed well and operating as intended.
The pack is a complete control questionnaire, ready to run on AutoQ Standalone or Enterprise Version 3.1 alongside your other reviews, with its own installer. Your team answers each control and records the evidence it inspected, and AutoQ writes the statement of fact, risk, effect and recommendation for every answer, rates each domain and produces the reports.
High-risk controls are those where a failure most directly enables an attacker to gain access or prevents recovery.
Who it's for
- IT auditors and internal audit teams
- Information security and risk managers
- Compliance teams preparing for ISO/IEC 27001 or a NIST-based assessment
- Consultants assessing a client's cyber security
When to use it
- An annual cyber security controls review
- A readiness check before certification or a customer audit
- A baseline assessment for a new client or acquisition
What it covers
Governance and Risk
20 controls, 3 of them high risk
High-risk focus: an annual cybersecurity risk assessment, security clauses in contracts with service providers, and security assessments of high-risk providers.
Examples of the controls:
- A cybersecurity risk assessment is performed at least annually and after significant changes, and its results are reported to management.
- Contracts with service providers include security requirements, breach notification within an agreed time and a right to audit.
- An information security policy is approved by senior management, communicated to all staff and reviewed at least annually.
Identity and Access
20 controls, 9 of them high risk
High-risk focus: unique accounts, prompt removal of access for leavers, quarterly access reviews, dedicated and reviewed admin accounts, no default accounts, and multi-factor authentication for remote, administrative and externally exposed access.
Examples of the controls:
- Each user has a unique account, and shared or generic accounts are not used for interactive logins unless individually approved and monitored.
- Access is removed within one business day of termination, and on the same day for involuntary terminations.
- Access is granted only after approval by the system or data owner.
Technical Protection
20 controls, 8 of them high risk
High-risk focus: secure configuration baselines, vulnerability scanning with timely remediation, monthly patching, anti-malware on every device, full-disk encryption, network segmentation, and encryption of sensitive data.
Examples of the controls:
- Documented secure configuration baselines exist for each type of system and are applied before systems go into production.
- Authenticated vulnerability scans of internal systems run at least quarterly, and scans of externally exposed systems at least monthly.
- Drift from configuration baselines is detected automatically and corrected or approved within 30 days.
Detection and Monitoring
20 controls, 6 of them high risk
High-risk focus: logging of security events, central and tamper-resistant log collection, round-the-clock alert monitoring, endpoint detection and response, alerts on privileged activity, and cloud misconfiguration monitoring.
Examples of the controls:
- Security-relevant events, including authentication, privilege use, configuration changes and access to sensitive data, are logged on all critical systems.
- Logs are collected centrally in a security information and event management (SIEM) or log platform that administrators of the source systems cannot alter.
- Logs are retained for at least 12 months, with at least 90 days immediately searchable.
Incident Response and Recovery
20 controls, 8 of them high risk
High-risk focus: a current incident response plan, consistent incident handling, timely breach notification, annual exercises including ransomware, frequent backups with an immutable copy, quarterly restore tests, and a tested disaster recovery plan.
Examples of the controls:
- A documented incident response plan defines roles, severity levels, escalation and communication, and is reviewed at least annually.
- Incidents are recorded, classified by severity and handled according to the plan, with actions and times documented.
- An incident response team with named members, deputies and current contact details is designated, including external contacts such as legal advisers, insurers and law enforcement.
Frameworks
Every control carries references to NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and CIS Controls v8.1, so findings can be tied to the criteria your audit uses.
Criteria references mapped from NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 Annex A and CIS Critical Security Controls v8.1 (safeguard numbers). Verify against the editions your audit uses.
What's in the workbook
| Control Library | Every control with its domain and subdomain, the control assertion, type, nature, frequency and risk weight, the framework references, the suggested test procedure, the evidence to request, the statements of fact if true and if false, the effect if false and the recommendation. |
|---|---|
| Questionnaire | The working sheet the review team answers, control by control, with the evidence they inspected; AutoQ fills in the findings from the answers. |
| Domain Summary | The rating of each domain, weighted by risk, ready for the report. |
| Column Guide | What every column means and how it is used. |
| Sources | The framework editions the references were mapped from, with a column for the reviewer to record the date each reference was checked. |
Delivered with its own installer, which adds it to AutoQ as a new review (or as a .zip to add on the Admin tab). The questionnaire is an Excel workbook, so it can be adapted with your own controls and ratings.
The framework references were mapped from the published texts and should be checked by a qualified reviewer against the editions your audit uses. The pack supports a review; it does not replace professional judgement or the requirements of your regulator.