Cybersecurity Governance and NIST CSF 2.0: Scoping an Internal Audit

A cybersecurity internal audit can mean anything from a vulnerability scan review to a board governance review. The framework you choose determines the scope and the vocabulary in the report. NIST's Cybersecurity Framework 2.0, published February 26, 2024, is one framework an engagement can adopt as its criteria. This post explains how it is organized, how to turn it into an audit scope, and how to keep it separate from ITGC testing done for ICFR.

What CSF 2.0 is

NIST describes the CSF as guidance to industry, government agencies and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that any organization can use, regardless of size, sector or maturity, to understand, assess, prioritize and communicate its cybersecurity efforts. It does not prescribe how outcomes should be achieved; it links to resources on practices and controls.

The Core has six functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS) and Recover (RC). Govern is the first function listed and covers organizational context, risk management strategy, roles, responsibilities and authorities, policy, oversight, and cybersecurity supply chain risk management.

How it differs from ITGC testing

ITGC testing for ICFR is narrow by design. The SEC's interpretive guidance for management says management needs to evaluate only the IT general controls necessary for the proper and consistent operation of other controls that address financial reporting risks, and need not evaluate ITGCs that relate only to the efficiency or effectiveness of operations. A cybersecurity audit asks a broader question: how well does the organization manage cybersecurity risk to its business, including confidentiality, availability and recovery. Keep the scopes and the conclusions separate. Evidence from a cybersecurity audit may help ITGC conclusions, but a clean cybersecurity report does not by itself show that financial reporting controls were effective. See /us/blog/it-audit-guide-itgc-program-and-checklist.

From functions to audit questions

IIA requirements

Standard 9.4 Internal Audit Plan requires the internal audit plan to consider coverage of information technology governance and other high-risk areas. The IIA's Cybersecurity Topical Requirement became effective February 5, 2026, and internal auditors are required to conform with relevant Topical Requirements when an engagement's scope includes the identified topic. See /us/blog/internal-audit-topical-requirements-cybersecurity-third-party-and-organizational-behavior. Standard 13.2 Engagement Risk Assessment requires auditors to gather information about applicable frameworks, guidance and other criteria for evaluating the processes under review, and Standard 13.4 Evaluation Criteria requires them to identify the most relevant criteria. The CSF can be the stated criteria for the engagement.

Sample scope

• Objective. Provide assurance on the design and operating effectiveness of the processes that govern, identify, protect, detect, respond to and recover from cybersecurity risk to the company's financial systems and customer data.
• Scope. Corporate IT and the cloud ERP environment; excluded: operational technology in plants (separate engagement).
• Criteria. NIST CSF 2.0 outcomes listed above, with company policies.
• Approach. Document review, interviews, tests of access reviews and backup restores, review of the incident register, and a tabletop observation.
• Period. The twelve months ended on the planning date.

Worked finding

Criteria: GV.RM-02 (risk appetite and tolerance statements established, communicated and maintained) and GV.OV-01 (cybersecurity risk management strategy outcomes reviewed to inform and adjust strategy). Condition: the board approved an enterprise risk appetite statement that mentions financial and reputational risk but not cybersecurity or data loss, and the board received one cybersecurity update in 12 months, with no metrics. Cause: ownership of cybersecurity reporting sits with the IT director without a defined route to the audit committee. Effect: the board cannot determine whether current cybersecurity risk is within its tolerance, so Standard 11.5 Communicating the Acceptance of Risks escalation (management accepting risk above tolerance) cannot function. Recommendation: add cybersecurity tolerance statements, set quarterly metrics, and give the chief information security officer a standing agenda item. See /us/blog/communicating-risk-acceptance-to-the-board-standard-11-5.

Mistakes to avoid

• Scoping every CSF subcategory in one engagement. Select by risk.
• Reporting a "maturity score" with no criteria definition.
• Treating Govern as a policy review. It covers oversight, accountability and supply chain.
• Presenting cybersecurity findings as ICFR conclusions.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024): https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
• SEC, Release No. 33-8810, Section II.A.1.d: https://www.sec.gov/rules/interp/2007/33-8810.pdf
• The IIA, Global Internal Audit Standards (2024), Standards 9.4 Internal Audit Plan, 11.5 Communicating the Acceptance of Risks, 13.2 Engagement Risk Assessment, 13.4 Evaluation Criteria: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• The IIA, Topical Requirements (effective dates): https://www.theiia.org/en/standards/topical-requirements/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error