Orientation

When: During audit planning, after the preliminary survey. What it does: Select the entity type (Organisation, organisation-IT, organisation-OT, CII, Autonomous Body), audit type (Compliance, VAPT, VfM, Follow-up), and total available fieldwork days. The builder calculates domain priorities based on entity risk profile, generates a full audit programme table with test procedures and evidence requirements for each domain, and estimates time allocation. Print directly from the browser for your working papers.

When: Continuously during fieldwork as risks are identified. What it does: Log each risk with a title, domain, and 1–5 scores for Likelihood and Impact. The register auto-calculates the Inherent Risk score (L×I), assigns a rating (Critical ≥20 / High ≥12 / Medium ≥6 / Low), and plots all risks live on a 5×5 colour-coded heat-map matrix. Entries persist across sessions. Use this to prioritise findings and brief the auditee on their overall risk profile.

When: Before each interview session. What it does: 156 field-tested questions organised by 11 audit domains and 7 interviewee roles (CISO, Network Admin, System Admin, Application Owner, DBA, Cloud Admin, OT Engineer). Filter by domain and role to build a tailored list for each interview. Check off questions as you ask them — progress saves automatically. Print a session-specific question sheet to take into the interview.

When: When drafting audit findings at end of fieldwork or per day. What it does: A 6-step wizard that guides you through the institutional C5 structure — Criteria, Condition, Cause, Effect, Recommendation. Each step provides pre-built templates for each audit domain that you click to pre-fill and customise. The final step generates a formatted observation paragraph ready to copy into your working papers or inspection report. Always replace placeholder text with specifics from your evidence.

When: At the end of fieldwork, once you have enough evidence to rate the entity. What it does: Rate the entity on 10 cybersecurity dimensions (Governance, IAM, Network, Endpoint, Application, Data Protection, BCP/DR, Incident Response, OT/ICS, Physical) on a 1–5 maturity scale. Generates a live radar chart and a copy-ready summary paragraph for working papers. Scores persist across sessions.

When: When writing findings and needing the correct legal citation. What it does: Maps 11 audit areas to specific clauses in 5 frameworks — applicable cyber law, official incident-response service Directions 2022, data-protection guidance, ISO 27001:2022, and NIST CSF 2.0. Click any clause badge to read exactly what that section requires. Use the reference in the Criteria field of your findings.

When: When establishing legal consequences for the inspection report. What it does: Select the applicable law and violation type. Returns the exact section reference, maximum penalty or consequence, parties liable, enforcement authority, and audit citation notes. Covers 30+ violation types across cyber-safety law, official incident-response service Directions, data-protection guidance, ISO 27001, and NIST CSF 2.0.

When: During training or before your first engagement of a new entity type. What it does: Three end-to-end audit scenarios — Central Organisation, State organisation with OT systems, and Healthcare Entity — showing how a real engagement unfolds from entity profile through risk assessment, fieldwork plan, key findings, and model report paragraphs. All entities are fictional composites, not real institutional audits.

When: After completing the reading layer (Parts 0–10). What it does: 30 questions across 5 themed rounds — Foundations, Legal & Regulatory, Methodology, Technical Audit, and Reporting. Score 24/30 or higher (80%) to earn a printable Completion Certificate with your name. Each question shows a full explanation after answering, so the assessment also serves as a revision session. Your certificate is stored in the browser — enter your name before starting.

Often operate both corporate IT (ERP, finance, HR) and, in sectors like power, oil & gas, and manufacturing, OT/ICS environments running production. These are your highest-stakes IT+OT audits — see Part 5.

Regulators, universities, research bodies. IT footprints are smaller but often hold sensitive personal or research data, raising data-protection guidance considerations (Part 2).

Municipal corporations, smart city SPVs, water utilities, traffic management — increasingly running SCADA/IoT for utilities and surveillance, frequently with weaker dedicated IT security staffing than central organisations.

Power generation/transmission/distribution, ports, railways, telecom backbone. May fall under critical-infrastructure coordination body-notified "Critical Information Infrastructure" — handle with the heightened sensitivity and coordination described in Part 5.9.