{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:b1b1849f755b1bd298e35c5fe4919ba4e021cf217f67943330cb40b47b726828","slug":"audit-cybersecurity-assurance-review","url":"/assets/agent_workflow-audit-cybersecurity-assurance-review-f037787e.9e3de893558db663.json"},"kind":"record","record":{"attributes":{"department":"internal-audit","domain":"audit","lineOfDefense":"assure"},"canonicalUrl":"https://workflow-library.com/all/?w=audit-cybersecurity-assurance-review","description":"Cybersecurity Assurance Review — a CAE-owned assurance engagement that runs on the EXISTING Audit item opened from the audit plan (audit_type=it_audit, status PLANNED, lead_auditor and scope already set): the workflow instance attaches to that item and enriches it end to end, never creating a duplicate engagement record. It covers the three IIA Cybersecurity Topical Requirement domains (governance, risk management, and control activities) over the cyber estate bounded in the engagement memo (in scope: named legal entities, networks, cloud tenants, and OT/ICS where included; out of scope: areas whose assurance is documented as delivered by other engagements), testing against the NIST 800-53 Rev 5 catalog with CSF 2.0 / ISO 27001 as the aggregation frame. It originates from the audit plan (no upstream workflow) and produces the findings register (one four-Cs Issue per finding), the cyber posture summary carrying the per-domain and overall Standard 14.5 conclusions, and the approved engagement package — which it hands to the downstream Audit Report Drafting workflow.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=audit-cybersecurity-assurance-review","capabilities":[],"controls":["UC-AUDIT-12","UC-AUDIT-13","UC-AUDIT-16","UC-AUDIT-23","UC-GOV-15","UC-VULN-01","UC-LOG-04","UC-IR-01","UC-BCDR-13","UC-LOG-01","UC-LOG-03","UC-LOG-05","UC-LOG-08","UC-VULN-05","UC-AUDIT-14"],"domains":["audit"],"lineOfDefense":"assure","mappingStatus":"mapped","releaseId":"sha256:b1b1849f755b1bd298e35c5fe4919ba4e021cf217f67943330cb40b47b726828","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[{"code":"reliance-basis-incomplete","message":"Template-design warning: material reliance is mapped without a tagged step covering the full provider-reliance basis.","missing":["independence","competence","evidence","recency","reliance rationale"],"nodeIds":[],"title":"Reliance basis is incomplete"}]},"sourceTemplateId":"workflow-library:audit-cybersecurity-assurance-review","standards":["iia-2024","nist-800-53"],"teams":["internal-audit","it"]},"id":"wf:A1","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AA1","slug":"audit-cybersecurity-assurance-review","sourceIds":["ccpa","cobit-2019","hipaa","iia-2024","iia-pos-2026-three-lines","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Cybersecurity Assurance Review","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0cd3e97c2f6b55449f7405198ed81050e893088fc21d7753862324610d954923","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-log-01-022e9745.json","targetId":"uc:UC-LOG-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:170c42229ec9a57072ebf720b3ffb3736229acdb6c363100a6b6a15abe9a5e73","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-log-04-4bc40d21.json","targetId":"uc:UC-LOG-04","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2dcfa618d47adf7e586b6a2709784b266b1cfe1396ca8f761a7868b51db3f768","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-ir-01-e7711d29.json","targetId":"uc:UC-IR-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2e9b78ce4f889888e2f0f94a8c1785ababdf655392b47c414e5f1b1d61d3e482","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-bcdr-13-aa7feb8e.json","targetId":"uc:UC-BCDR-13","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:428c026fc872feacfc3bcb33ebce571038422462b6955d4d8233ad4f794392ae","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-audit-13-3dae730e.json","targetId":"uc:UC-AUDIT-13","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:49080fcf25ba6d133104c2a0b3241a81044f4eb4d087a991df62bf93e4b8b04e","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-log-05-8f316c34.json","targetId":"uc:UC-LOG-05","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74a3b281689173508bb29d096de111a1099ecade86488716b57193cfcb1a7251","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-vuln-05-5870fcee.json","targetId":"uc:UC-VULN-05","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9beee782eb85c483af1b7bd330b68dec1a6387a7ffe086e621bbd4ce8e43e9f6","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","targetId":"uc:UC-VULN-01","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9cf38263f7dcd9d05134c60213463561e06eaabf61b43f7ecb14362142620692","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-gov-15-828b3eec.json","targetId":"uc:UC-GOV-15","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9faf8a94071e8116b366bb45920bf621cc6c6119423787e39bfe5790e13c6009","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-audit-23-124d94d5.json","targetId":"uc:UC-AUDIT-23","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a873951546d90fcbca4c325e69a0f87b30d197b0f040d85933dc1d70f90c9052","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-audit-16-03aa1161.json","targetId":"uc:UC-AUDIT-16","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4172bf537c1d97b457873b123638286ca9ff745475af298eb505c84e7ee2207","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-audit-14-5c0dbe8f.json","targetId":"uc:UC-AUDIT-14","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b4486a90fcc13709963f058683c39a2d32b25fff3c3fe9ad3aa0472fdb33c500","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","targetId":"uc:UC-LOG-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5f3a802faa65ddf01a584ae86132626cadfc53d8a42697c0ce70f2bdaf75880","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-audit-12-657c1271.json","targetId":"uc:UC-AUDIT-12","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:db5684f229b26006269194ee553baf34a83d4a5826de3ec5189802ca226dc43d","properties":{},"sourceDetailPath":"/data/v1/records/wf-a1-f09c8201.json","sourceId":"wf:A1","targetDetailPath":"/data/v1/records/uc-uc-log-08-61745e12.json","targetId":"uc:UC-LOG-08","type":"tests"}],"schemaVersion":1}