Evidence does not belong in an email attachment
Before the audit comes the request list, and then exports, ZIP files and sharing links go to the audit body. After the audit, nobody knows where the copies are, which version was presented or who saw it. IT-Grundschutz module DER.3.1 requires the opposite: auditors do not intervene, access is withdrawn afterwards, and only authorised people can reach the documents.
Three weeks before the audit, the audit body's request list arrives: sixty items, from the policy to the last restore test log. The security team exports, renames, packs ZIP files and sends them by email or as a sharing link. The audit goes well.
Six months later, the files are still in the auditor's mailbox, in a forward to a colleague, in the audit body's ticket system and on a laptop that has since been replaced. And when a finding becomes disputed, nobody knows exactly which version of the emergency manual was presented.
What Grundschutz requires
Module DER.3.1 Audits and reviews governs not only how audits are carried out, but also how access and documents are handled. Basic requirement A3 already states for the on-site audit that the audit team must ensure (our translation)
"that it never actively intervenes in systems itself"
Auditors read, they do not change. For closing the audit, A24 requires the information security officer to close the access again (our translation):
"The ISO SHOULD have all access approved for the audit or review team deactivated or deleted."
In addition, it should be agreed that the results may not be passed on to other institutions without the audited institution's approval. And A27 requires for filing that only authorised persons can access audit programmes and documents.
Why the attachment does not fit
- A copy cannot be withdrawn. Access can be deactivated, a sent attachment cannot. The requirement from A24 simply cannot be met by email.
- The version is not recorded. Anyone who sends a file and then revises it cannot later prove which version was audited. That becomes important exactly when a nonconformity is disputed.
- Nobody knows who saw what. A forwarded link opens for anyone who has it. Whether the auditor opened it or the colleague she forwarded it to, no log shows.
How to do it better
The alternative is not a ban but a different route: the auditor gets time-limited read access to exactly the areas to be audited, on a frozen version. Every access is logged, at the end there is a handover record with checksums, and then access is closed. That covers A24 and A27, and the dispute about the version disappears because it is recorded. What the audit programme for this looks like was covered in An audit date is not yet an audit programme.
How isidaten represents this
In the Auditor workspace, the auditor sees only released areas from frozen audit snapshots, no live data. If an area deviates from the frozen version, it is reported as disturbed and not delivered. Besides the link, access requires a one-time code sent to the stored address, so that a forwarded link alone is not enough. Every access is logged before it is delivered, and rejected attempts too. At the end, a handover record freezes what was presented: identifiers, checksums and timestamps, but no content. It is the only document the auditor can download.
The check question
Where is the evidence from your last audit today, and who can still open it?
If the answer is "in the audit body's mailbox", the requirement from A24 is open, even if the audit was passed.
Sources
BSI IT-Grundschutz Kompendium, 2023 edition, module DER.3.1 Audits und Revisionen, requirements A3, A24 and A27 (German).
Questions about this update?
Talk to us – we are happy to show you this feature in a demo.