Audit of Cybersecurity and Data Protection: Recap of BRICS Supreme Audit Institutions Seminar

BRICS Supreme Audit Institutions (SAIs) held a seminar in video conference format on 6 June 2024 to consider ways to ensure information security at government agencies, as well as audit methods in this regard.

Denis Strizheusov, deputy director of the Financial Audit Department at the Russian Accounts Chamber, provided a detailed description of the three main stages of how the Accounts Chamber conducts an information security audit of international organizations: it studies the organization’s job instructions and descriptions, assesses operational efficiency, and conducts the procedures associated with a technical security audit. He highlighted the role of ISO 27001 and ISO 27002 standards in the information security of international organizations and provided an analysis of how these standards are applied in audits. Andrey Shcheverov, director of the Digital Transformation Department, also took part in the seminar on behalf of the Accounts Chamber.

André Torres Breves Gonçalves, an inspector at the Information Security Assessment Department of the Federal Court of Accounts of Brazil, gave a presentation in which he described in detail the main stages and methods for checking whether government agencies are prepared for phishing attacks. The SAI of Brazil checked whether government employees click on potentially malicious links, enter their personal data on unfamiliar sites, and download files from untrusted sources. The report also noted that the SAI of Brazil analysed some 14,000 URLs of government agencies at various administrative levels. An information security risk matrix was compiled based on the analysis. Following the checks, the entities that were audited provided plans to improve their information security controls.

Chester September, an expert in cybersecurity and information systems audits at the Auditor-General of South Africa, spoke about the cybersecurity audit methods used in South Africa. To conduct a cybersecurity audit, the SAI of South Africa has developed a methodology to verify the maturity of cybersecurity management processes, which includes an assessment of vulnerabilities and testing for security against hacking. September also stressed the need for constant interagency cooperation between government agencies on cybersecurity issues.

The representative of the Chinese National Audit Office, Cui Zhu, spoke about the focuses of cybersecurity audits conducted by the SAI of China. In particular, when verifying how prepared an organization is to prevent cybersecurity threats, the SAI of China primarily assesses the security of network architecture, network access management, and cybersecurity log management, as well as how to prevent unauthorized access and malware penetration. She said that it is crucial to consolidate existing cybersecurity standards into a single document, as well as train skilled professionals in order to improve security auditing in China.

Deepak Raghu, director of the Information Systems Audit at the Office of the Controller and Auditor General of India, provided details about the main stages of ensuring cybersecurity in India and the SAI’s role in this process. Government organizations in India must independently conduct internal information security audits, but external experts can also be involved. The SAI of India periodically assesses whether the information security systems of government agencies comply with legal requirements. Raghu noted that state requirements for cybersecurity apply not only to government agencies, but also to large private companies in such areas as telecommunications, medicine, and finance.

The SAIs of the countries that joined BRICS on 1 January 2024 attended the seminar.

The meeting participants agreed to continue exchanging experience on cybersecurity audits and expressed hope for continued regular interaction in the format of the SAIs of BRICS countries.

The Roscongress Foundation manages the events of Russia’s BRICS Chairship.