Create your first audit

An audit (also called a compliance assessment) measures a perimeter against a framework such as ISO/IEC 27001:2022. Creating one takes two moves: import the framework from the library catalog, then create the audit itself. From there, the work is answering requirements one by one.

This walkthrough assumes you already have a domain and perimeter.

Import a framework

1. In the sidebar, open Governance → Libraries. The catalog lists every library available to your instance — frameworks, threat catalogs, risk matrices and more.

2. Search for the framework you need, for example ISO/IEC 27001:2022, and click the import icon on its row.

3. Once loaded, the framework appears under Loaded libraries and in Catalog → Frameworks, ready to be used by audits.

Tip

Libraries bundle related objects: many framework libraries pull in a companion set of reference controls automatically. Import once, reuse everywhere — see Libraries.

Create the audit

1. Open Compliance → Audits and select New Audit.

2. Give the audit a Name and pick your Domain and, optionally, your Perimeter.

3. Choose the Framework. If you have imported only one, it is selected for you.

4. Save, then open the audit. CyberGuard creates one requirement assessment per requirement in the framework — this is your worklist. You can edit the audit’s details later at any time.

Answer your first requirements

1. In the audit view, browse the requirement tree and select a requirement to open its assessment.

2. Record a Result: Compliant, Partially compliant, Non compliant, or Not applicable. Requirements start out as not assessed.

3. Attach what substantiates your answer: link the applied controls that satisfy the requirement (create them as you go with Add applied control), and attach evidences — a file, a link or a description — with Add evidence.

4. Update the requirement’s status as you work — To do, In progress, In review, then Done. The audit’s progress bars fill in as requirements are completed.

Note

Result and status are deliberately separate: the result is the compliance verdict, the status is where you are in the work. A requirement can already be Compliant yet still be In review, and the audit’s progress figure tracks the work, not the verdicts.

Because applied controls are decoupled from requirements, a control you describe once — your access management process, your backup routine — can be attached to many requirements across many audits without rewriting it. That reuse is where CyberGuard saves you the most time as your audit portfolio grows.

Related

• Audits
• Evidences
• Applied controls
• Create your first risk assessment