Protect production during audit testing by agreeing in advance which methods and tools the auditor may use, setting limits, and recording the plan. ISO 27001 control 8.34 asks that audits do not harm operational systems. Keep the agreed scope, timing and tool list on file.
What the control requires
The control has two parts. First, agree with the auditor on allowed methods and IT audit tools. Second, make sure audits do not affect the performance or security of operational systems.
Most companies already have what they need: access control, backups and monitoring. A procedure is recommended, not mandatory. Smaller organizations can write it into the internal audit procedure.
Before the test: a short plan
Records that show testing was planned and agreed between testers and management are what auditors may check. Put these in the plan:
- Which systems and data are in scope
- Which tools and methods are allowed
- Dates and times, ideally off peak
- A named contact on each side
- What to do if something breaks
Decision table
| Situation | Safer choice |
|---|---|
| Auditor wants to scan a live app | Test a staging copy first |
| Auditor needs read access to data | Read only account, time limited |
| Scan could slow production | Schedule off peak, rate limit |
| Tool is unknown | Review it before it touches a system |
During and after
- Use read only access where possible
- Watch monitoring while tests run
- Have a recent backup before testing starts
- Remove temporary accounts afterwards and record it
Why it matters for AppSec teams
Audit scans use the same techniques an attacker would, so they can trip alarms or slow a service. Telling your monitoring team in advance prevents a false incident.
What to tell your own team
Audit testing can look like an attack from the inside. Tell the people who watch alerts which source addresses and times to expect, and give them the named contact on the audit side. Agree in advance how to stop a test early. After the test, note any alert that fired. A false alarm that was explained by the plan is itself a good record that your monitoring works and that testing was agreed rather than improvised.
Quick check
Does this apply to your own internal audits too?
Yes. The guidance mentions internal auditors, who should be trained to plan and perform audits on information systems securely.
What should we keep as evidence?
The agreed plan, the tool list, approvals and a note that temporary access was removed.
Where tooling helps
Safeguard offers compliance and evidence automation, which can store audit plans and access records. The agreement with the auditor is a conversation your team has. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
