[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-34":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-34","Annex A 8.34","Protection of information systems during audit testing",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Plan and agree audit tests and other assurance activities involving assessment of operational systems between the tester and appropriate management.\n\n**In practice.** Audit and assessment activities, including technical testing, are scoped and approved in advance, with access limited to what is needed, preferably read-only. Tests that could affect availability are scheduled outside business hours or run against copies. Auditor access is monitored, logged and removed when the work finishes, and any copied data is protected and deleted afterwards. Evidence includes engagement letters or rules of engagement, approvals, access logs and confirmation of access removal.\n\n**Common gaps.** Auditor and assessor accounts are often given broad privileges and never removed. Disruptive scans are sometimes run against production without agreed timing, and data extracted for audit is left on laptops or file shares.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]