O4.9 Mandate security audits by third parties

Principle

O4 Assure data security by design

Risks

RS2 Digital insecurity, SV1 Digital distrust

Lifecycle Stages

L5 Operations and Maintenance

Practices

• Develop guidelines and criteria for selecting qualified third-party auditors with expertise in data security, ensuring audits are thorough and credible.

• Mandate regular security audits for all DPI systems and require the findings to be transparently reported to relevant stakeholders, including government bodies and the public.

• Use audit results to identify vulnerabilities and enforce timely implementation of recommended security enhancements, ensuring continuous improvement of DPI system security.