ISO 27001 Annex A 8.34 Protection of information systems during audits
What it says
Audit tests and other assurance activities involving assessment of operational systems shall be planned and agreed between the tester and appropriate management.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure audit activities are planned and agreed with management to prevent system disruptions.
This control is about making sure that when audits are conducted on your business's IT systems, they don't disrupt operations or expose sensitive information. It's important because unplanned audits can cause system crashes, data breaches, or loss of important information, which can seriously affect the business.
Free. Save your status, tasks and notes.
Why it matters
Unplanned audit testing on live systems can disrupt critical services, causing outages or data loss and harming business performance and reputation.
How to implement
The IT manager should coordinate with management to ensure audit activities are scheduled at times that won't disrupt operations, like during off-peak hours.
This involves creating a calendar of audit events and getting approval from management for the timing.
Senior management should define clear agreements with those conducting audits about what systems and data they can access.
This means specifying who can see what, and putting it all in a written agreement to avoid misunderstandings.
The security team should ensure that auditors have only read-only access to data wherever possible.
They should prepare isolated copies of system files for audits, so the real data remains untouched, and protect these copies with passwords or encryption.
IT staff need to verify that any devices used for audits, like laptops or tablets, meet security standards.
This includes checking that software is up to date and has antivirus protection, to prevent introducing security risks.
Request any special access for auditors to run specific tests is tracked and authorised.
This can be done by having a checklist that ensures these requests go through proper channels and get the right approval before access is given.
Keep it running
Plan and agree audit tests for operational systems in advance with management; schedule like a change, define scope/window, obtain approvals and monitor for disruption.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The audit schedule and approvals from management.
Look at
The details of when audits were planned compared to when they happened.
Good evidence
Shows no unexpected audits disrupting operations.
- Check 2 of 5What an auditor asks for
Good evidence
Would show clear limits on what auditors were allowed to view or do.
- Check 3 of 5What an auditor asks for
Ask for
Logs of system access during audit periods. Look over these logs to see if only authorised accounts accessed data and no excessive permissions were granted.
Good evidence
Demonstrates restricted and monitored access.
- Check 4 of 5What an auditor asks for
Good evidence
Includes specific measures taken to secure every device used for audit purposes.
- Check 5 of 5What an auditor asks for
Ask for
Records of any additional processing or tests done by auditors. Review these records to ensure they were authorised and controlled.
Good evidence
Consists of proper documentation and limited tests conducted during audits.
Mappings
Closest match in ASD Information Security Manual: ISM-1524, Ensure rigorous testing of content filters, which partially overlaps with this control.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-1524.
Annex A 8.34 requires audit tests and other assurance activities involving operational systems to be planned and agreed between testers and management. ISM-1524 relates by mandating rigorous security testing of CDS content filters, and such testing often needs careful scheduling and agreed test conditions to avoid impacting operational filtering or information flows. ISM-1524 is narrower and technology-specific (CDS content filters), while Annex A 8.34 is a general control about governance and coordination of testing on operational systems.
This control partially overlaps ISM-1563.
Annex A 8.34 requires audit tests and other assurance activities involving operational systems to be planned and agreed with management. ISM-1563 relates because it governs how a security assessment is concluded and documented (scope, risks, control effectiveness and remediation), which is part of the overall assurance process that Annex A 8.34 is trying to execute safely. ISM-1563 focuses on assessment reporting outputs, whereas Annex A 8.34 focuses on pre-execution planning and management agreement to protect system availability and integrity during testing.
This control partially overlaps ISM-1636.
ISM-1636 requires system owners (with the authorising officer) to have security controls for systems and their operating environment assessed by internal assessors or IRAP to confirm controls are correctly implemented and operating as intended. ISO/IEC 27001:2022 Annex A 8.34 relates by requiring audit tests/assurance activities on operational systems to be planned and agreed with management, which is a key safeguard when conducting the types of assessments ISM-1636 calls for. Annex A 8.34 focuses on controlling the conduct and safety of audits, whereas ISM-1636 mandates that an independent security control assessment occurs (including assessor source and system classification scope).
This control partially overlaps ISM-1967.
ISM-1967 specifies the need for assessment of TOP SECRET controls by ASD assessors. ISO/IEC 27001:2022 Annex A 8.34 requires planned and agreed testing and assurance on operational systems, including coordination of audits. While ISM-1967 gives a specific mandate for certain systems, Annex A 8.34 provides guidance on testing arrangement, which overlaps in scope with ISM-1967 in ensuring operational controls are effectively assessed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.