The IIA's New Cybersecurity Requirement for Internal Auditors
What the Cybersecurity Topical Requirement Means for Internal Auditors
On February 5, 2025, the Institute of Internal Auditors (IIA) introduced a new Cybersecurity Topical Requirement, which took effect on February 5, 2026, and is now mandatory for assurance engagements. This requirement provides a structured framework for internal auditors to assess cybersecurity risks in conformance with the Global Internal Audit Standards™.
For organizations with internal audit functions, this update has raised the bar for cybersecurity audits. It introduces mandatory requirements for assurance services and recommended guidance for advisory engagements, ensuring that cybersecurity audits are conducted with consistency, quality, and accountability.
What does this mean for internal auditors and cybersecurity decision-makers now that the requirement is in force? Let’s explore the key changes, challenges, and how organizations can close any remaining gaps.
What is the Cybersecurity Topical Requirement?
The Cybersecurity Topical Requirement is part of the IIA’s International Professional Practices Framework (IPPF) and aligns with global best practices. It provides a standardized approach to cybersecurity auditing by focusing on three critical areas:
Cybersecurity Governance – Evaluates an organization's cybersecurity strategy, policies, and oversight mechanisms.
Cybersecurity Risk Management – Assesses how organizations identify, mitigate, and monitor cybersecurity risks.
Cybersecurity Controls – Reviews internal controls, vendor security, incident response, and regulatory compliance measures.
Who Does This Cybersecurity Topical Requirement Affect?
Internal auditors must apply the Cybersecurity Topical Requirement when:
Cybersecurity is part of the internal audit plan.
Cyber risks emerge during an engagement (even if they were not originally in scope).
Management, regulators, or the board request a cybersecurity audit.
These requirements help strengthen cybersecurity oversight and protect organizations from cyber threats.
Key Cybersecurity Audit Areas Under the New Requirement
Cybersecurity Governance
Internal auditors must assess whether an organization has:
A documented cybersecurity strategy aligned with business objectives.
Board oversight of cybersecurity risks, resources, and funding.
Up-to-date policies and procedures to manage cybersecurity threats.
Clearly defined roles and responsibilities for cybersecurity teams.
Cybersecurity Risk Management
The requirement mandates that internal auditors evaluate:
Risk identification, analysis, and mitigation processes.
Cybersecurity risk monitoring across all business functions (IT, compliance, HR, finance, supply chain, etc.).
Incident escalation procedures for cyber threats.
Ongoing risk communication to management and employees.
Cybersecurity Control Processes
Internal auditors must assess how organizations:
Protect IT systems and sensitive data through internal and vendor-based security controls.
Maintain an incident response and recovery plan that is regularly tested.
Implement cybersecurity controls across IT asset management, cloud services, and vendor partnerships.
Ensure compliance with cybersecurity frameworks like NIST, COBIT, and ISO 27001.
By applying these standards, organizations can enhance cyber resilience and mitigate threats before they escalate.
Challenges for Internal Audit Teams
While this requirement was designed to improve cybersecurity audit consistency, many internal audit teams are finding it difficult to implement it due to:
Lack of Cybersecurity Expertise – Many internal audit teams lack specialized cyber auditors, making it harder to assess technical risks.
Limited Resources – Internal audit teams may not have enough personnel to conduct in-depth cybersecurity audits while balancing other responsibilities.
Complexity in Compliance – Cybersecurity audits must align with multiple frameworks and regulations (e.g., NIST, ISO 27001, CMMC, PCI DSS), requiring deep technical knowledge.
Because the requirement is now effective, gaps in any of these areas are no longer a future risk. They're a current exposure the next internal audit quality assessment could surface.
For organizations facing these challenges, outsourcing or co-sourcing cybersecurity audits with experienced IT audit professionals can be a practical solution.
How Our IT Audit Services Can Help
At Clark Schaefer Consulting, we specialize in IT Audit Outsourcing and Co-Sourcing to help internal audit teams navigate the complexities of cybersecurity compliance.
IT Audit Outsourcing – We conduct full cybersecurity audits on your behalf, ensuring alignment with the IIA’s Cybersecurity Topical Requirement.
Co-Sourcing Support – Our cybersecurity specialists collaborate with your internal audit team, providing technical expertise while keeping you in control.
We evaluate your cybersecurity audit approach, identify gaps against the current requirement, and help you close them before they surface in a quality assessment.
Whether you need full outsourcing or targeted support, our team ensures your cybersecurity audit program is compliant, effective, and resilient against risks. Contact us today to ensure your cybersecurity audits meet the current standard.
Expert Contributors
