A cyber security audit is the broad review of how well an organisation protects its systems and data. VAPT is one technical test inside that review. An ISO 27001 audit checks whether a company runs an information security management system to a published standard. They answer different questions, so passing one does not replace the others.
Last reviewed: 17 October 2026. Facts checked. We read the full text of CERT-In's Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, dated 25 July 2025, and NIST's glossary definition of penetration testing. We tried to open ISO's own page on ISO/IEC 27001 and it returned a 403 error, so we did not read it. Our description of ISO 27001 here is general and rests on our own earlier article on the standard.
The three, side by side
| Cyber security audit | VAPT | ISO 27001 audit | |
|---|---|---|---|
| What it is | Broad review of security controls and practice | Technical test of systems for weaknesses | Audit of a management system against a standard |
| Main question | Are our security controls adequate? | Can someone break in? | Do we run and improve a security system, as the standard asks? |
| Method | Document review, interviews, configuration checks, tests | Scanning and attack simulation | Document review, interviews, sampling of records |
| Output | Audit report with findings | Technical report with ranked weaknesses | Audit result against the standard's requirements |
| Frequency | CERT-In's guidelines say at least once a year | Often with the annual audit and after big changes | Set by the certification cycle and your own programme |
The cyber security audit
CERT-In's 2025 guidelines treat the cyber security audit as an umbrella. The types they list include compliance audits, risk assessments, vulnerability assessments, penetration testing, network infrastructure audits, operational audits, IT security policy review, source code review and process security testing. So VAPT sits inside the list, next to many other kinds of review.
The same guidelines say an organisation should get a comprehensive audit of its ICT systems at least once a year, and may do more during the year.
VAPT
VAPT is the technical test. A vulnerability assessment finds weaknesses. A penetration test, which NIST describes as mimicking real-world attacks, tests whether they can be exploited. For the details, see our guide on VAPT and how auditors use the reports.
The ISO 27001 audit
ISO/IEC 27001 is a standard for an information security management system, usually shortened to ISMS. An audit against it asks whether the company has defined its risks, chosen controls, run them and reviewed them. It looks at the system as a whole, rather than trying to break in. We cover how it works in our ISMS explainer and our ISO 27001 internal audit guide.
An important difference is who asks. A cyber security audit is often driven by a regulator or a contract. ISO 27001 is usually something a company chooses, often because a customer asks for it.
Which one do you need?
| Situation | Likely need |
|---|---|
| A regulator or customer asks for an annual security audit | Cyber security audit, with VAPT inside it |
| You launched a new web or mobile application | VAPT on that application |
| A large customer wants proof of a security programme | ISO 27001 certification or an equivalent report |
| Your statutory auditor asks about IT controls over financial reporting | ITGC audit |
| You want one view of where you stand | Start with a cyber security audit, then add the others |
The statutory audit has its own lens, covered in IT audit vs ITGC vs cyber security audit.
How they fit together
Many companies layer them. The ISMS gives the framework. The cyber security audit tests whether it works. The VAPT proves the technical defences hold up under attack. The findings from each feed the next cycle.
For an auditor reading these reports, the key checks are the same in each case:
- Was the scope right for what the auditor cares about?
- Was the reviewer independent?
- Is the report recent enough?
- Were the findings fixed and retested?
A short internal checklist helps. Our general internal audit checklist is a starting point, and the ITGC audit workbook covers the IT controls an auditor of financial statements tests.
Frequently Asked Questions
Is VAPT enough to call a company secure?
No. VAPT tests technical weaknesses at one point in time. It does not review policies, people or processes.
Does ISO 27001 include a penetration test?
Not as a fixed part, as far as we can say. We did not open the standard. Many companies run VAPT alongside it as a separate exercise.
Which is cheaper?
It depends on scope and provider. We did not find a reliable public price source, so we give no figures.
Can one provider do all three?
Often yes, but ask about independence. A provider that built your controls should not be the one that audits them.
Who sets the audit frequency?
CERT-In's 2025 guidelines say at least once a year, and note that sector regulators may increase it. Check your own regulator.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error