Audit & Evidence

Auditor perspectives, evidence packs, checklists, audit day preparation guides

CI/CD Security Testing Controls — SAST, DAST, and SCA from the Auditor’s Perspective

by

Comparing CI/CD Security Testing Controls: What Auditors, Compliance Officers, and Regulators Need to Know Security testing controls in CI/CD pipelines — commonly referred to as SAST, DAST, and SCA — are frequently compared based on technical detection capabilities. For auditors and compliance officers, the relevant comparison dimensions are different: control objectives, evidence quality, enforcement capability, … Read more

DAST Tool Governance — What Auditors Should Verify in Tool Selection and Deployment

by

When auditing an organisation’s application security programme, the selection and deployment of Dynamic Application Security Testing (DAST) tools is a critical control point. A poorly governed tool selection process — or the absence of one — signals systemic weakness in how the organisation manages security tooling across its software delivery lifecycle. This guide provides auditors, … Read more

DAST in Regulated Environments — Auditor’s Guide to Assessing DAST Controls

by

Dynamic Application Security Testing (DAST) is a critical runtime security control in regulated software delivery environments. For auditors, compliance officers, and regulators, the question is not which DAST tool an organisation uses, but whether DAST controls are adequate, enforced, and evidenced. This guide provides a structured framework for assessing an organisation’s DAST controls within CI/CD … Read more

How Auditors Actually Review SAST Controls in Regulated Environments

by

Static Application Security Testing (SAST) is often presented as a core DevSecOps control. However, there is a significant gap between how security teams believe auditors assess SAST and how auditors actually do it. In regulated environments, auditors do not evaluate SAST tools as security products. They evaluate them as operational controls within the software delivery … Read more

SAST Tool Selection for Enterprises — Audit Checklist

by

SAST Tool Selection — Enterprise Audit Table Scope: Evaluation of a Static Application Security Testing (SAST) tool for enterprise and regulated CI/CD environments. # Control Area Audit Question Yes No 1 Governance Does the tool support policy-based enforcement (block / warn / report-only)? ☐ ☐ 2 Governance Can policies be defined per application, team, or … Read more

SAST Tool Governance — What Auditors Should Verify in Tool Selection and Deployment

by

Static Application Security Testing (SAST) is a foundational control in secure software delivery. However, the presence of a SAST tool alone does not constitute an effective control. Auditors, compliance officers, and regulators must assess whether the organisation’s SAST tool governance — from selection through ongoing operation — meets the standards required by frameworks such as … Read more

SAST in Regulated Environments — Auditor’s Guide to Assessing SAST Controls

by

Static Application Security Testing (SAST) is a foundational security control in regulated software delivery environments. For auditors, compliance officers, and regulators, the critical question is not which SAST tool an organisation has selected, but whether SAST controls are effective, enforced, evidenced, and governed. In regulated environments, SAST is not a tooling decision — it is … Read more

How Auditors Actually Review CI/CD Pipelines

by

CI/CD pipelines are increasingly in scope during security and regulatory audits. While many organizations focus on policies and tooling descriptions, auditors assess CI/CD pipelines very differently in practice. This guide explains how auditors really approach CI/CD reviews, what they look for first, how they test controls, and why many organizations fail audits despite having “secure” … Read more

DORA Article 21 — Evidence Pack for Auditors

by

What to Show, Where to Find It, and Why It Matters This evidence pack lists the technical and operational artifacts that financial institutions should present to demonstrate compliance with DORA Article 21.It focuses on CI/CD pipelines as regulated ICT systems and emphasizes reproducible, audit-ready evidence. How to Use This Evidence Pack Article 21(1) — ICT … Read more

DORA Article 21 — Auditor Checklist (CI/CD & ICT Risk Management)

by

This checklist is designed to assess compliance with DORA Article 21 requirements through CI/CD pipeline controls and supporting ICT processes.It supports internal audits, supervisory reviews, and regulatory assessments. Article 21(1) — ICT Risk Management Framework Control Check Yes No CI/CD pipelines are included in the ICT risk management scope ⬜ ⬜ ICT risks related to … Read more