Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges.

• Preface xiiiAcknowledgments xvAbout the Companion Website xvii1 The Role of Audit in Security Governance, Risk, and Compliance 12 Security Standards and Regulations 193 Risk Assessment and Control Design for Modern Systems 354 Evidence, Sampling, and Testing Techniques 515 Auditor Ethics, Independence, and Professional Judgment 716 Identity and Access Management 897 Network and Perimeter Security 1058 Application and API Security/CI-CD 1259 Cloud and SaaS Security 14110 Data Protection 15711 Logging, Monitoring, and Detection 17712 Incident Response and Crisis Management 19713 Vulnerability Management and Pen Test Oversight 21914 Third-party and Supply-chain Security 23915 OT/ICS and Critical Infrastructure Audits 26116 Sector Overlays (Financial, Healthcare, Public) 28517 Automation, Continuous Auditing, and Advanced Analytics 30318 AI Threat Modeling and Attack Surfaces 32319 Secure MLOps and Model/Endpoint Controls 34120 AI Monitoring and Incident Response 35921 Audit Reporting and Executive Communication 37922 Annual Audit Planning and Capability Development 399Chapter Answers 419Glossary 445Index 453

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges.

• Preface xiiiAcknowledgments xvAbout the Companion Website xvii1 The Role of Audit in Security Governance, Risk, and Compliance 12 Security Standards and Regulations 193 Risk Assessment and Control Design for Modern Systems 354 Evidence, Sampling, and Testing Techniques 515 Auditor Ethics, Independence, and Professional Judgment 716 Identity and Access Management 897 Network and Perimeter Security 1058 Application and API Security/CI-CD 1259 Cloud and SaaS Security 14110 Data Protection 15711 Logging, Monitoring, and Detection 17712 Incident Response and Crisis Management 19713 Vulnerability Management and Pen Test Oversight 21914 Third-party and Supply-chain Security 23915 OT/ICS and Critical Infrastructure Audits 26116 Sector Overlays (Financial, Healthcare, Public) 28517 Automation, Continuous Auditing, and Advanced Analytics 30318 AI Threat Modeling and Attack Surfaces 32319 Secure MLOps and Model/Endpoint Controls 34120 AI Monitoring and Incident Response 35921 Audit Reporting and Executive Communication 37922 Annual Audit Planning and Capability Development 399Chapter Answers 419Glossary 445Index 453

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges.

• Preface xiiiAcknowledgments xvAbout the Companion Website xvii1 The Role of Audit in Security Governance, Risk, and Compliance 12 Security Standards and Regulations 193 Risk Assessment and Control Design for Modern Systems 354 Evidence, Sampling, and Testing Techniques 515 Auditor Ethics, Independence, and Professional Judgment 716 Identity and Access Management 897 Network and Perimeter Security 1058 Application and API Security/CI-CD 1259 Cloud and SaaS Security 14110 Data Protection 15711 Logging, Monitoring, and Detection 17712 Incident Response and Crisis Management 19713 Vulnerability Management and Pen Test Oversight 21914 Third-party and Supply-chain Security 23915 OT/ICS and Critical Infrastructure Audits 26116 Sector Overlays (Financial, Healthcare, Public) 28517 Automation, Continuous Auditing, and Advanced Analytics 30318 AI Threat Modeling and Attack Surfaces 32319 Secure MLOps and Model/Endpoint Controls 34120 AI Monitoring and Incident Response 35921 Audit Reporting and Executive Communication 37922 Annual Audit Planning and Capability Development 399Chapter Answers 419Glossary 445Index 453