Cyber Compliance and Assurance: Board Briefing

Most organisations now pay for the same security controls to be evidenced several times a year, to several auditors, by people who should be running those controls, and the board still cannot say with confidence whether the controls work between audits. This briefing is for directors, audit and risk committee members, chief executives, finance leaders and CISOs who approve compliance budgets and sign statements about internal control. It covers three things a board can change: the burden that repeated audits place on the business, how far evidence collection can be automated, and what assurance actually costs against what it proves. It does not restate the discipline, which sits in the Audit, Assurance and Compliance Guide, or how to build a board cyber report, which sits in the Board Cyber Risk Reporting Guide.

The risk in one paragraph

Compliance and assurance spending grows one framework at a time: a SOC 2 report because a customer asked, ISO/IEC 27001 because a tender required it, a regulator's questionnaire, an internal audit plan, cyber insurance renewals and dozens of customer security reviews. Each arrives with its own control list, its own evidence requests and its own calendar, so the same access review or backup test is screenshotted for five audiences. The cost is not only fees. It is senior engineers pulled into evidence gathering, controls tuned to pass on audit day, and a board that receives a set of clean reports which describe the past, sample a small part of the population and say little about today. The risk to the board is twofold: money spent on activity that does not reduce risk, and false assurance, where directors sign or rely on a statement about controls that nobody has tested since the last visit.

Why this is a board-level issue now

Directors in the UK now declare on controls. The FRC's UK Corporate Governance Code 2024, published on 22 January 2024, asks boards in Provision 29 to make a declaration on the effectiveness of their material internal controls, covering reporting, operational and compliance controls, for financial years beginning on or after 1 January 2026. Boards decide which controls are material, base the declaration on their own monitoring and review, and decide whether to seek external assurance. The FRC has published guidance on Provision 29 that includes a focus on cyber.
US listed companies disclose board oversight. The SEC rules adopted on 26 July 2023 require annual Form 10-K disclosure under Regulation S-K Item 106 of processes for managing material cybersecurity risk, the board's oversight and management's role and expertise, and Form 8-K Item 1.05 disclosure generally within four business days of determining that an incident is material. What the annual report says about oversight has to match how oversight really works.
Regulators are moving from annual snapshots to continuous evidence. FedRAMP 20x, the US federal cloud authorisation programme's new approach, uses key security indicators validated automatically where possible, and the programme's own site states that continuous evidence of what is happening is stronger than a policy saying it should happen. As published in 2026, FedRAMP plans to stop accepting new Rev5 certifications on 11 June 2027. Suppliers to government, and their customers, will feel that shift.
Internal audit's mandate has been reset. The IIA's 2024 Global Internal Audit Standards organise the profession into five domains and include principles that internal audit is authorised by the board and overseen by the board. Audit committees are expected to direct internal audit at the risks that matter, not to accept a plan built around what is easy to test.
Not every attestation is equal. The AICPA has said it is investigating allegations about a compliance vendor's SOC business practices. Boards and procurement teams relying on supplier reports, and companies buying their own, should care who performed the work and how.

Where the burden and cost come from

Source of cost	What it looks like	What reduces it
Overlapping frameworks	The same control described, owned and tested differently for SOC 2, ISO/IEC 27001, regulators and customers	One common control set mapped to every framework, one owner and one test per control. See the Control Mapping Guide
Manual evidence gathering	Screenshots, exports and spreadsheets assembled in the weeks before fieldwork	Automated collection from cloud, identity, ticketing and endpoint systems into a timestamped evidence store
Audit calendar clashes	Several audits and reviews landing in the same quarter on the same teams	A single assurance calendar, aligned audit periods and shared evidence across auditors
Customer questionnaires	Hundreds of bespoke security questionnaires answered by hand	A maintained trust pack: current reports, certificates, standard questionnaire responses and a policy for what is shared under NDA
Findings that recur	The same access review or leaver exceptions year after year	Fix the process behind the control, not the evidence; track repeat findings at committee level
Point-in-time fixes	Controls tightened before the audit window, relaxed afterwards	Continuous checks on the controls that drift most, with exceptions visible to the second line

Not all of this can be automated. Configuration, identity, logging, patching and backup state lend themselves to automated tests of the full population. Judgement controls, such as risk acceptance, supplier assessment quality and incident decisions, still need people and sampling. The Continuous Compliance vs Point-in-Time Audits guide sets out where each model gives false comfort.

Five questions for the board to ask

How many audits, certifications and assessments do we pay for, and what does each one tell us that the others do not? A good answer lists them with cost, internal effort, audience and the decision or contract each supports. If two produce the same assurance for different audiences, ask whether one report can serve both.
Do we test each control once and reuse the evidence, or once per framework? Ask for the number of distinct controls against the number of framework requirements mapped to them, and how many evidence requests the busiest control owner received last year.
What share of our key controls is tested continuously, and which ones can only be tested by people? A credible answer gives a percentage, names the controls in each group and explains how the automated tests themselves are checked so that a broken data feed does not show green.
If we had to make a declaration on our material controls tomorrow, what evidence would support it? This applies directly to boards reporting against the UK Code under Provision 29, and is a good discipline for any board that signs or relies on control statements. Ask which cyber controls management considers material and why.
What did our last cycle of audits change? Assurance is worth paying for when it leads to decisions: findings closed, controls redesigned, investment moved. Ask for repeat findings, overdue actions and exceptions accepted, with owners and dates.

Red flags in management answers

"We passed the audit": a clean report describes a period that ended months ago and a sample, not the current state.
A separate project team per framework: usually means duplicate controls, duplicate evidence and nobody with the full picture.
Dashboards with no tested data lineage: a compliance tool reporting 98 percent passing is only as good as the integrations behind it and the rules it runs.
Audit fees as the only cost reported: the internal time spent gathering evidence is often larger and is rarely measured.
Choosing the cheapest attestation provider: the board and customers rely on the auditor's independence and rigour, not only on the logo.
Machine identities outside scope: access reviews that cover employees but not service accounts, API keys and automation credentials leave the fastest growing population untested.

What good looks like

Area	Weak position	Good position
Control set	One control list per framework	One common control set with owners, frequency and evidence, mapped outward to every framework
Evidence	Collected manually before each audit	Collected automatically where possible, timestamped, stored once and shared with every auditor
Monitoring	Annual audit is the only test	Continuous checks on high-drift controls, periodic independent assurance on top, as NIST SP 800-137 describes for continuous monitoring programmes
Lines of defence	Security marks its own homework	Control owners operate, the second line monitors and challenges, internal audit gives independent assurance to the audit committee
Supplier assurance	Reports filed on receipt	Reports read for scope, period, exceptions and the controls the customer must run itself
Board reporting	List of certificates held	Coverage of material controls, freshness of evidence, repeat findings and the cost of assurance

Where to invest first

Priority	Investment	Why it comes first
1	Assurance inventory and calendar	The board cannot rationalise what it cannot see; this is a few weeks of work with existing data
2	Common control framework	Removes duplicate testing and is the precondition for any automation; see the Compliance Automation Guide
3	Automated evidence for high-volume controls	Access, configuration, logging and backup evidence account for much of the evidence effort and are the easiest to automate
4	Internal audit coverage of cyber	Gives the audit committee an independent view between external audits; see the Internal Audit for Cybersecurity Guide
5	Platform tooling	Buy a compliance or GRC platform after the control set is agreed, not before; see the Compliance Automation Buyer's Guide

Small and large organisations: a smaller company with one SOC 2 report and a few customer reviews usually gains most from a common control list, a trust pack and automated evidence from its cloud and identity provider. A large or listed group with several regulators and certification bodies needs a central assurance function, a single calendar, internal audit coverage of material cyber controls and evidence pipelines that the external auditor has tested and agreed to rely on.

Metrics to track

Cost of assurance: external fees plus estimated internal hours for each audit, certification and major customer review, trended annually.
Control reuse ratio: framework requirements satisfied per distinct control tested.
Automated evidence coverage: percentage of key controls with automatically collected, timestamped evidence.
Evidence freshness: median age of evidence supporting material controls at the time of board reporting.
Repeat findings: number of audit findings raised in two or more consecutive cycles.
Overdue actions: audit actions past their agreed date, by owner and severity.

Report these to the audit committee at least twice a year alongside the cyber risk report, so the cost and quality of assurance are seen together.

A 90-day plan

Days 1 to 20, inventory: list every audit, certification, regulatory return, insurance assessment and recurring customer review, with cost, internal effort, audience, period and owner. Name one accountable executive for assurance.
Days 15 to 45, map: build or adopt a common control set and map the main frameworks to it. Identify duplicate controls, controls with no owner and controls tested more than once a year for different audiences.
Days 30 to 60, choose controls to automate: pick ten to twenty high-volume controls in identity, configuration, logging and backup. Agree with the external auditor how automated evidence will be tested before relying on it.
Days 45 to 75, align the calendar: align audit periods where contracts allow, set one evidence request process, and publish a trust pack for customer reviews.
Days 60 to 90, report: present the baseline metrics, the material controls list and a proposal to retire or consolidate any low-value assurance activity to the audit committee.

Run automated checks alongside manual evidence for at least one audit cycle before retiring the manual process, so a gap in the automation is found by the team rather than by the auditor.

Where identity fits

Identity controls generate more audit evidence than almost any other area: joiners and leavers, access reviews, privileged access and multi-factor authentication. They are also the best candidates for automation, because the data lives in directories and identity platforms. Service accounts, API keys and automation tokens are often outside access reviews entirely. Bringing non-human identities into the common control set, with owners and evidence, closes a gap that auditors increasingly ask about. See Board Briefing: NHI Risk.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OV-01, GV.OV-03	Leadership review of risk strategy outcomes and of risk management performance
NIST CSF 2.0	ID.IM-02	Improvements identified from tests and assessments
NIST SP 800-53 Rev. 5	CA-2, CA-5, CA-7	Control assessments, plan of action and milestones, continuous monitoring
NIST SP 800-137	ISCM programme	Continuous monitoring of assets, threats, vulnerabilities and control effectiveness
ISO/IEC 27001:2022	Clause 9	Monitoring, internal audit and management review
UK Corporate Governance Code 2024	Provision 29	Board declaration on material internal controls
SEC	Regulation S-K Item 106	Disclosure of risk management and board oversight

Common failure patterns

Buying a platform before agreeing controls: the tool encodes the duplication it was meant to remove.
Automating without auditor agreement: evidence the auditor will not rely on still has to be produced manually.
Treating certificates as assurance: the board sees logos, not coverage, freshness or exceptions.
Measuring fees, not effort: the largest cost, staff time, stays invisible and keeps growing.
Leaving judgement controls behind: automation covers configuration well, and risk acceptance or supplier review quality gets less attention than before.

Practitioner checklist

Maintain one inventory of all audits, certifications, regulatory returns and customer reviews with cost and effort.
Run a common control set mapped to every framework in scope.
Automate evidence for high-volume identity, configuration, logging and backup controls.
Agree reliance on automated evidence with external auditors in advance.
Define which cyber controls are material and how their effectiveness is evidenced.
Report cost of assurance, evidence freshness and repeat findings to the audit committee.
Include non-human identities in access reviews and control evidence.

Standards and references

How NHI Mgmt Group can help

We provide independent assessments of identity and non-human identity controls, board briefings and support for bringing machine identities into control frameworks and audit evidence. Our NHI Foundation Level Training Course helps security, GRC and audit teams understand machine credentials. Contact us to arrange a briefing.

Cyber Compliance and Assurance: A Board Briefing on Audit Burden, Evidence and Cost