This document summarizes information about performing a security audit. It discusses examining physical security by checking where systems are located and who can access them. It also recommends verifying that security guards are employed and have been properly vetted. The document outlines that audits can be external, internal, or self-conducted. The main objectives of an audit are to assess the adequacy of security measures, physical security risk management processes, and verification that roles and responsibilities for security are clearly defined.

1. Security Audit-
Information –Physical
© COPYRIGHT PLN9 SECURITY SERVICES PVT. LTD. ALL RIGHTS RESERVED
PLN9, A Complete Security Solution In Association
With Tyco

2. Introduction

3. 1- Security audit is an audit on the level of information security in an
organization. Within the broad scope of auditing information security
there are multiple types of audits, multiple objectives for different audits,
etc. Most commonly the controls being audited can be categorized to
technical, physical and administrative.
2- Auditing information security covers topics from auditing the physical
security of data centers to auditing the logical security of databases and
highlights key components to look for and different methods for auditing
these areas.

4. • 1-In examining physical security, the auditor should be concerned with
where the system is physically located and which physical locations it can
be accessed from.
• 2- It may be necessary to check that security guards are employed to
guard against intruders (and that they—and the company they work for—
are trustworthy and reliable and have been subjected to a police check).
How to Perform a Security
Audit

5. Types Of Audits

6. 1- External : These are conducted by a third party
2- Internal : Corporate : By headquarters
or
Personnel from other units of the same company.
3- Self : In –house – by the plant personnel themselves.

7. Audits Objectives

8. 1- The main objective of the audit is to assess the adequacy and
effectiveness of EC’s security measures and management controls,
through four specific objectives focusing on high-risk areas.
2- To assess the adequacy of the physical security threat identification and
risk management process, with a focus on activities performed at the
facility level.
3- To determine whether roles and responsibilities of all parties involved in
departmental physical security are clearly defined, performed by the
appropriate party, and cover the span of security activity, as defined by
the TB Policy on Government Security;

9. Thank you