Be audit-ready and continuously compliant with an independent, evidence-based internal audit delivered by qualified lead auditors. Cyber Security Centre helps organizations meet ISO/IEC 27001 Clause 9.2 requirements and strengthen their management system through practical findings, clear remediation actions, and a report your certification body will recognize.

Benefits

• Certification readiness: Demonstrate Clause 9.2 compliance with a structured internal audit and formal report.
• Risk-based assurance: Validate that controls are operating effectively—not just documented.
• Actionable outcomes: Clear nonconformities and improvement opportunities you can turn into corrective actions.
• Flexible delivery: Remote audits via Microsoft Teams or Zoom across Australia and New Zealand.
• Capability uplift: Options to build internal audit capability while maintaining independence and quality.

Standards we audit:

Whatever the internal audit requirements, Cyber Security Centre can help! Our qualified lead auditors can provide internal audits for:

• ISO/IEC 27001 – Information Security Management System (ISMS)
• ISO/IEC 27017 – Cloud security controls and shared responsibility guidance
• ISO/IEC 27018 – Protection of PII in public cloud environments
• ISO/IEC 27701 (Privacy Information Management System)
• ISO/IEC 27035 / 27043 (Incident Management & Investigation)
• ISO 22301 (Business Continuity Management)
• ISO/IEC 42001 (AI Management System)

What you receive

A professionally compiled audit pack including:

• Audit plan and agenda aligned to your scope and audit schedule
• Evidence log and audit trail mapped to standard requirements and (where applicable) your Statement of Applicability
• Findings summary including strengths, nonconformities, and improvement opportunities
• Clear remediation guidance to support corrective action planning and continual improvement
• Audit report suitable for certification bodies to demonstrate Clause 9.2 compliance

Cyber Security Centre audits consist of a combination of document review and remote discussions with appropriate management and staff. Relevant documented information will be reviewed as evidence that the defined processes and procedures are being followed.

After the audit we provide a professionally compiled report that details:

The agenda and all areas audited within the management system and Statement of Applicability in line with the requested scope.
Evidence examined and audit trail for all areas of the standard including:

• Positive findings – the things the organization is doing well.
• Nonconformities – areas found to be non-compliant against the requirements of the ISO standard which can then be used to drive continual improvement.

The report can be used by the organization to demonstrate to an external certification body that the organization is meeting the internal audit requirements of the standard.

Cyber Security Centre offers 2 Internal Auditor interactions though:

• Consulting-led internal audit
  Our lead auditor plans and performs the audit end-to-end, supported by a nominated internal contact.
• Mentored internal audit (capability uplift)
  We co-develop the plan and guide your nominated staff member through the audit, strengthening internal competence while maintaining ISO-aligned structure and outcomes.