Security Audit Report

Detects security audit reports including SOC 2, ISO 27001, and IRAP findings.

Type

regex

Confidence

medium

Confidence justification

Medium confidence: keyword-based detection requires corroborative evidence for accurate identification.

Jurisdictions

global

Regulations

AML/CTF Act (Cth), IPA 2009 (Qld), Privacy Act 1988 (Cth)

Frameworks

ISO 27001, NIST CSF, PCI-DSS

Data categories

security, audit

Scope

narrow

Risk rating

8

Should match

• Security audit report — Low-tier probe - report title without control evidence
• Security audit report: control objective, control activity, and trust services criteria reviewed. — Medium-tier probe - security-control evidence without a classified finding
• Security audit report: control objective and Annex A review found a high risk finding, audit exception, and required action. — High-tier probe - security-control evidence plus classified findings

Should not match

• Security guard audit of premises — Physical-security sibling
• Home security system review — Consumer-security sibling
• The public assurance page links to a security audit report. — Public link mentions only the report title
• Template example: security audit report with control objective, Annex A, high risk finding, audit exception, and required action. — Template contains otherwise high-tier evidence

Known false positives

• Physical security or home security references. Mitigation: Require IT security framework terms like SOC 2, ISO 27001, or IRAP.