Questions your auditor and your board will ask

Eight questions come up again and again. Each is answered by one or more of four IT records. Select a question or a record to see the links. Staff devices are part of the estate too.

Where to get professional help: your auditor, a qualified lawyer, the regulator for your sector, your insurer’s broker, or an accredited certification body.

The story in six steps

1. The binder-and-annual-audit era

   • According to the SEC, US Sarbanes-Oxley section 404 rules require companies filing under the Exchange Act (not registered investment companies) to include in their annual report “a report of management on the company’s internal control over financial reporting”. Management cannot conclude controls are effective if a material weakness exists. The rule took effect on 14 August 2003. (SEC rule page)
   • According to the US Department of Defense, the CMMC programme’s own history says the department announced CMMC in 2019 “to move away from a self-attestation model of security”. (CMMC Program rule)

   In plain words: For years, evidence meant a binder of policies and a once-a-year audit visit.

2. The shift to cloud and shared responsibility

   • According to the UK National Cyber Security Centre (NCSC), security is shared between customer and cloud provider, and the split depends on the service type. (NCSC, shared responsibility model)
   • According to the NCSC, the customer always remains accountable for the service meeting its security needs, for configuring the chosen services securely, and for “deciding which data you store in the services you use”.
   • According to the NCSC, on-premises the customer is fully responsible; in other models responsibility is split.

   In plain words: The provider looks after its platform; configuration, access and data stay with you.

   Provider certificates describe the provider’s platform. Whether any one customer’s setup meets a rule is a separate question. (Our plain-language reading of the NCSC page, not a quote.)

3. Why pressure has grown

   • Public-company disclosure. According to the SEC, rules adopted on 26 July 2023 require public companies to disclose material cybersecurity incidents on Form 8-K generally within “four business days after a registrant determines that a cybersecurity incident is material”, and to describe risk management, board oversight and management’s role annually in Form 10-K. Smaller reporting companies get an extra 180 days before 8-K disclosure starts. The rule took effect on 5 September 2023 and was published in the Federal Register on 4 August 2023. (SEC press release, SEC rule page)
   • Privacy law. According to the European Commission, the GDPR applies to organisations established in the EU, and to those outside the EU offering goods or services to people in the EU or monitoring their behaviour. (European Commission)
   • Sector rules. According to EIOPA and ENISA, the EU Digital Operational Resilience Act (DORA) applied from 17 January 2025 to financial entities in the EU. (EIOPA, ENISA)
   • Supply chain. According to the NCSC, citing the 2025 Security Breaches Survey, “very few UK businesses set minimum security standards for their suppliers”; the NCSC adds that visible supply chain security “may help you win new contracts”. (NCSC, supply chain security)

   In plain words: More rules, more reporting deadlines, and more customers asking for proof.

   The NCSC statement does not show that customer questionnaires are rising, and we found no sourced figure for that.

4. Continuous evidence instead of annual audits

   • According to the PCI Security Standards Council, requirements marked as future-dated were “best practices” until 31 March 2025, after which they “are required, and they must be fully considered during a PCI DSS assessment”; 51 of the 64 new requirements were future-dated. (PCI SSC blog)
   • According to CISA’s Cross-Sector Cybersecurity Performance Goals v2.0 (December 2025), good practice includes logs stored in a central system accessible only to authorised users, a maintained asset inventory, and change management with configuration control that prohibits unauthorised changes. (CISA performance goals)
   • According to the SEC, the 8-K timing runs from the moment of the materiality decision, so records must be available fast.

   In plain words: Auditors and regulators increasingly want to see current records, not last year’s snapshot.

5. On-premises and hybrid estates carry the full load

   • According to the NCSC, on-premises the customer is fully responsible.
   • According to the US Department of Defense, CMMC applies to contractors and subcontractors handling Federal Contract Information and Controlled Unclassified Information, and the department describes a four-phase implementation over three years. (CMMC Program rule)

   In plain words: Servers you run yourself have no provider certificate to lean on. Hybrid estates need both pictures at once.

6. The IT estate link: which records an auditor asks for, and where they come from

   • According to CISA, good practice names an asset inventory (maintained regularly), centralised logs, and change control. (CISA performance goals)

   In plain words: Four records answer most auditor questions: the CMDB, access logs, change records and monitoring alerts. The diagram below shows which record answers which question.

Myth or fact

Rule families

Names and purposes only, with examples from the US, EU and UK. This table does not say that King Tech or any reader meets any of these. Where a cell says “our reading”, the source does not state it.

Planning for this in your organization?

King Tech collaborates on custom solution architecture: we work alongside your team to design an approach that fits your systems, your constraints and your timeline. Contact King Tech to start the conversation.

Book a consultation Ask a question

Sources

1. SEC press release 2023-139 (26 July 2023). Checked Oct 25, 2026.
2. SEC rule page, Release 33-11216 (issued 26 July 2023; effective 5 September 2023). Checked Oct 25, 2026.
3. UK NCSC, Cloud security shared responsibility model (published 10 May 2022, reviewed 7 June 2023). Checked Oct 25, 2026.
4. PCI Security Standards Council, PCI DSS. Checked Oct 25, 2026.
5. PCI Security Standards Council blog, e-commerce requirements effective after 31 March 2025 (26 March 2025). Checked Oct 25, 2026.
6. ISO, ISO/IEC 27001 committee page (Edition 3, October 2022). Checked Oct 25, 2026.
7. European Commission, Data protection explained. Checked Oct 25, 2026.
8. European Data Protection Board, SME data protection guide: Be compliant. Checked Oct 25, 2026.
9. US Department of Defense, CMMC Program rule, Federal Register (published 15 October 2024). Checked Oct 25, 2026.
10. US Department of Defense, CMMC DFARS rule, Federal Register (published 10 September 2025). Checked Oct 25, 2026.
11. CISA, Cross-Sector Cybersecurity Performance Goals v2.0 (December 2025). Checked Oct 25, 2026.
12. UK NCSC, Supply chain security (published 28 January 2018, reviewed 22 October 2025). Checked Oct 25, 2026.
13. EIOPA, Digital Operational Resilience Act (DORA). Checked Oct 25, 2026.
14. ENISA, DORA is now binding (17 January 2025). Checked Oct 25, 2026.
15. SEC, management’s report on internal control over financial reporting (SOX section 404 rule, effective 14 August 2003). Checked Oct 25, 2026.

Facts checked Oct 25, 2026.

General information, not legal or audit advice.