5. Conclusion

A company's attack surface is (too) large to resist targeted attacks. Despite this fact, it is necessary to regularly assess the security level of certain critical parts of the company's infrastructure. This calls for a methodology that identifies the assets to be protected, defines the security measures to be implemented (cf. ISO 27001) and carries out the verification phase (the audit), which serves as the entry point for the compliance phase.

As IT environments continue to change (particularly in a highly competitive context), and the environment becomes increasingly hostile, it is essential to regularly assess the level of security of those parts of the enterprise considered critical. In this sense, auditing is essential, and has a bright future ahead of it.