Choosing the frame
Before a cybersecurity compliance audit begins, decide what it will be measured against. The benchmark might be a regulatory requirement such as New York's cybersecurity regulation for financial services companies, a contractual commitment to customers, an industry framework, or a payment card standard. Each produces a different set of findings, and an audit against the wrong frame can miss the obligations the company actually faces. Scope matters as much as the benchmark: which systems, business units, and vendors are covered. Narrow scopes produce clean reports that may not hold up when an incident happens outside them. It also helps to settle in advance who receives the report and in what form, since circulation affects both privilege and how findings are later characterized.
Privilege and the findings problem
An audit that identifies serious gaps creates a document that regulators or litigants may later request. Some companies have counsel commission assessments meant to support legal advice, which can improve the chance of privilege, but routine audits required by regulation or contract are generally not privileged no matter who commissions them. The more important safeguard is what happens next. A finding that is documented, assigned an owner, and remediated on a schedule is defensible, while a finding left open for a long stretch without explanation is often what regulators and plaintiffs focus on.
Certifications and follow-through
Some regimes require senior officers to certify compliance, and New York's financial regulator requires covered companies to file an annual certification of compliance or an acknowledgment of the areas where they fall short. Signing a certification after an audit has identified unresolved gaps can expose the signer as well as the company. We help companies scope audits, interpret findings, build remediation plans, and decide how certifications should be handled. Our work often starts with the most recent audit report and its list of open items, because that shows quickly where paper and practice still diverge.
