1. Privacy compliance will be a key focus for internal audit

Frameworks & Standards	Year of Release
Description
NIST CSF	2014	An established best-practice framework for organization's seeking a program to assess cybersecurity practices against. Often required of contractors of the US federal government.
CIS Top 20	2008	Contains the prioritized, top 20 actionable security requirements for all organizations and serves as a good first framework for building a cybersecurity program.
ISO 27001/02	1995/2000	One of the most popular baseline security frameworks; serves as an international standard that outlines how organizations should manage information security.
ISACA COBIT 5	2012	IT management framework to help businesses develop, organize, and implement strategies around information management and governance.
PCI DSS	2006	A comprehensive list of security requirements designed to reduce credit card fraud and strengthen the security posture of organizations that store, process, or transmit card data.
HITRUST	2007	Helps organizations (especially healthcare) effectively manage data, information risk, and compliance, and demonstrate compliance with HIPAA requirements.

existing program. A few popular control frameworks and standards include:
When determining which framework to use, internal auditors will need to take into account industry standards, regulatory guidance, legal requirements, and the advantages and disadvantages of each framework. The selected framework will provide the structure, methodology, and best practices to achieve a strong security posture and prevent potential security vulnerabilities or data breaches. As an organization’s third line of defense, internal audit must play a key role in developing a strong cybersecurity program through an established cybersecurity framework to ensure a reliable, systematic way to mitigate cyber risk, regardless of how complex the environment.