This requirement exists to ensure timely planning and execution of certification renewals before expiration is consistently governed, documented, and capable of producing reliable assurance. Without it, audit activities may be inconsistent, difficult to evidence, or insufficient to support management, regulatory, and stakeholder decisions.
Document the required timely planning and execution of certification renewals before expiration; assign accountable roles and approval points; define minimum records and evidence; apply the approved audit methodology and risk criteria; and retain evidence of execution and review. Periodically review the process for changes in organizational risk, regulatory expectations, and audit scope.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: Circular §13 – Cyber security preparedness indicators |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 5(2)(f) – Approval and periodic review of ICT internal audit plans and audits Article 6(6) – Regular internal audit of ICT risk management framework |
EU
Regulation
|
vCurrent | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.5 – Monitor, Evaluate and Assess (MEA) > MEA02 – Managed System of Internal Control > MEA02.02 – Review effectiveness of business process controls. |
COBIT
Governance Framework
|
v2019 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OV – Oversight | GV.OV-03 – Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed ID.IM – Improvement | ID.IM-01 – Improvements are identified from evaluations PR.PS – Platform Security | PR.PS-04 – Log records are generated and made available for continuous monitoring |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.4 – ASSESSMENT, AUTHORIZATION, AND MONITORING; CA-4 – SECURITY CERTIFICATION |
NIST
Control Catalog
|
vRev. 5 | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |