Security Review
What is Security Review?
An examination of systems, applications, or processes to identify security weaknesses and verify compliance with security requirements.
Terms that appear alongside security review
Each of these is named in at least one of the same controls as security review. The number is how many controls name both.
- change management 3 shared controls
- compliance 2 shared controls
- security testing 2 shared controls
- risk assessment 2 shared controls
- secure coding 2 shared controls
- availability 2 shared controls
Frameworks that govern security review
What the standards actually require on security review
Requirements naming security review across 6 standards, quoted from the control text.
Agencies should carry out information security reviews of their systems, and document them, no less than once a year.
new-zealand-information-security-manual-nzism::6.1.7.C.01 · 6.1.7.C.01 Annual documented information security reviews of systems →Where a CII operator procures network products or services that may affect national security it must undergo the national security review organised by the CAC with the State Council departments (using unreviewed or failed products draws a fine of one to ten ti...
china-cybersecurity-law-csl::37-38 · Art. 37-38 CII procurement: national security review where national security may be affected, and security and secrecy agreements with providers →The state's data security review system conducts national security reviews of data processing that affects or may affect national security, and review decisions made according to law are final;
china-data-security-law-dsl::24-25 · Art. 24-25 Submit to national security review of data processing that affects national security; observe export control on controlled data →Undertakings perform varied information security reviews/assessments/testing to identify vulnerabilities, establish an information security testing framework validating the robustness of measures, with tests by independent competent testers, performed regularl...
EIOPA-ICTSG-GL.12 · Information security reviews, assessment and testing →Independent review of information security applies, and where the organization is a processor and individual customer audits are impractical or would increase risk, it should make available to customers, before and during a contract, independent evidence that...
iso-27701-2019::6.15.2 · Information security reviews →The organization shall, for all business partners except those falling under 4.3 or 4.4, examine the partners' processes and facilities to confirm that their security declarations hold good.
iso-28001-2007-supply-chain-security-management::4.5 · 4.5 Security reviews of business partners →Questions people ask about security review
What is Security Review?
Why is Security Review important for compliance?
Which compliance frameworks address Security Review?
Where can I learn more about Security Review?
See how Security Review applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.