Tick the boxes and the audit plan builds itself
Start from an example or build your own engagement: applicable frameworks, domains to cover and the risk level of each. The plan is recalculated with every box you tick.
Audit plan
Phases and effort
| Phase | Days |
|---|
Allocation of testing days
| Domain | Risk | Days | Weight | Questions |
|---|
In the full version, this plan comes straight away with:
- Work programme: the 0 questions, their test steps and the sample
- Questionnaires scored from 1 to 4, with observations
- Document request list, de-duplicated by domain
- Mapping to the selected frameworks
This version is used as part of an engagement.
What the generator produces
One scoping, six consistent deliverables
From the same ticked boxes, the generator draws on the 236 questions of the framework: the plan, the work programme, the questionnaires and the document list stay consistent with one another. On this site, each generator is shown through an example. The full version is used as part of an engagement.
Audit plan
Phases, effort and allocation of testing days by domain, in proportion to the risk assigned to each.
Build a plan →Work programme
The selected questions, with their test steps, sampling according to depth, expected evidence and references.
See a question →Scored questionnaires
One sheet per question, scored from 1 to 4 against criteria specific to each test, with the auditor's observation.
See a full test sheet →Documents to request
The expected evidence, grouped by domain and de-duplicated, to send to the auditee at kick-off.
See an extract →Mapping
For each article or clause of the selected frameworks, the questions that cover it, and the other way round.
See the frameworks covered →Summary of scores
Average, distribution of scores and findings scored 3 or 4 by domain, ready for the report.
See it in the case study →The six generators at work on a fictitious engagement : how it unfolds, the documents produced, one test performed and the summary.
Read the case study →The principle
Connect the standards rather than learn one more. One audit question, all its references.
The standards jungle is not going away. It will only get thicker, with artificial intelligence, resilience and third-party requirements. I do not believe we need to know one more standard. I believe we need to connect them, translate them into concrete tests and explain them simply to everyone.
| No. | The DIAG.IT method: test once, cover everything |
|---|---|
| 1 | Start from the audit question, not from the standard. |
| 2 | For each question, cite every standard and every article it covers, and apply the strictest requirement. |
| 3 | Specify the test method, the sample, the expected evidence and the scoring criterion. |
One test, documented once, serves every text at the same time. I did not want yet another catalogue. I wanted a translator : a simple question for the junior auditor, the precise reference for the expert, traceability for the supervisor.
Preview
What a test sheet looks like
Every question in the framework follows the same template: control objective, references, test steps, sampling, expected evidence, scoring criteria and point of attention. Here is a complete sheet, as used on an engagement.
ACCE-14Are access rights periodically recertified by application or data owners?
Verify that access rights are periodically reviewed by business owners and that anomalies are corrected. NIST PR.AA-05: define, manage, enforce and review access permissions.
- Obtain the frequency set by the policy and the last 2 reviews
- For the latest review, check the scope, the approvers and the return date
- Check that rights to be removed were actually removed (compare before and after)
- Reconcile approvers with the designated owners
Latest review: full coverage of the scope. n rights to be removed checked after the review.
Review reports; approvals; removal tickets; access rights listings
Review at the defined frequency, full scope, rights removed on time
Review at the defined frequency, 1 application out of scope or late removals
Partial review, or removals not carried out for 10 to 25% of rights
No review for more than 12 months, or removals not verified
Check that removals actually happened: a review without remediation has no effect.
A few other questions from the framework, with their references:
| Code | Audit question | References |
|---|---|---|
| ACCE-11 | Is multi-factor authentication enforced for all privileged access? | DORA art. 9(4)(d)ISO/IEC 27001:2022 Annex A.8.5NIS2 art. 21(2)(j)NIST CSF 2.0 PR.AA-03 |
| CONT-04 | Are restores tested regularly on critical systems, with results recorded? | DORA art. 12(2)ISO/IEC 27001:2022 Annex A.8.13NIST CSF 2.0 PR.DS-11GDPR art. 32(1)(c)GDPR art. 32(1)(d) |
| INCI-15 | If the entity is a financial entity, are major ICT-related incidents classified and reported to the authority within the deadlines set by the DORA regulation? | DORA art. 17DORA art. 18DORA art. 19DORA, technical standards DR 2024/1772DORA, technical standards DR 2025/301ISO/IEC 27001:2022 Annex A.5.26ISO/IEC 27001:2022 Annex A.5.31NIST CSF 2.0 RS.CO-02 |
| TIER-14 | Are exit and reversibility strategies defined, contracted and tested for critical services, including return and deletion of data? | DORA art. 28(8)DORA art. 30(2)(d)DORA art. 30(3)(f)ISO/IEC 27001:2022 Annex A.5.20ISO/IEC 27001:2022 Annex A.5.23ISO/IEC 27001:2022 Annex A.8.10NIST CSF 2.0 GV.SC-10GDPR art. 28(3)(g) |
| DONN-02 | Have processing operations likely to result in a high risk to individuals been subject to an impact assessment before they start, and are the selected measures applied? | ISO/IEC 27001:2022 Annex A.5.34ISO/IEC 27701:2025 6.1.2ISO/IEC 27701:2025 A.1.2.6GDPR art. 35GDPR art. 36 |
| IA-05 | Is the use of generative AI tools by staff governed (authorised tools, prohibited information, technical measures, contracts)? | ISO/IEC 27001:2022 Annex A.5.10ISO/IEC 27001:2022 Annex A.8.12ISO/IEC 42001:2023 5.2NIST CSF 2.0 PR.DS-01GDPR art. 32GDPR art. 5(1)(f) |
236 sheets of this kind, across 13 domains. The full library, with filters by framework, scoring and exports, is used as part of an engagement.
Contact me →Documents to request
A single list, sent on day one
Each sheet states the expected evidence. The generator groups it by domain and removes duplicates: the auditee receives a single list at kick-off, instead of requests trickling in. Here is an extract for four domains.
| Domain | Document requested | For question |
|---|---|---|
| ACCE | Current access and authorisation management policy | ACCE-14 |
| ACCE | Reports of the last two access reviews, with owners' approvals | ACCE-14 |
| ACCE | Removal tickets and access listings before and after the latest review | ACCE-14 |
| ACCE | List of privileged accounts and multi-factor authentication settings | ACCE-11 |
| CONT | Backup policy and minutes of the latest restore tests | CONT-04 |
| INCI | Incident classification procedure and incident register for the last twelve months | INCI-15 |
| INCI | Major incident notifications sent to the authority, with their dates | INCI-15 |
| TIER | Register of ICT third-party providers and contracts for critical services | TIER-14 |
| TIER | Exit strategies and reports of reversibility tests | TIER-14 |
Extract written for illustration. On an engagement, the list covers every selected question and then serves as a tracker: document received, version, date.
Traceability
Fourteen frameworks, 411 traced references
Every article, clause or subcategory cited is linked to the questions that cover it. The table below shows, for each framework, the number of traced references and the number of questions concerned.
| Framework | References | Questions |
|---|---|---|
| NIST CSF 2.0 | 101 | 233 |
| ISO/IEC 27001:2022 Annex (ISO/IEC 27002:2022 controls) | 93 | 210 |
| DORA (Regulation 2022/2554) | 65 | 102 |
| GDPR (Regulation 2016/679) | 44 | 34 |
| ISO/IEC 27001:2022 (clauses) | 43 | 36 |
| NIS2 (Directive 2022/2555) | 21 | 66 |
| ISO 22301:2019 (clauses) | 9 | 10 |
| AI Act (Regulation 2024/1689) | 6 | 5 |
| DORA, technical standards (RTS/ITS) | 6 | 10 |
| ISO/IEC 42001:2023 (clauses) | 5 | 4 |
| ITIL 4 | 5 | 17 |
| ISO/IEC 27701:2025 (clauses) | 4 | 4 |
| CRA (Regulation 2024/2847) | 2 | 1 |
| ISO/IEC 27017 | 1 | 1 |
This site does not reproduce the text of the standards: references point to the official texts. The detailed mapping table, article by article, is part of the version used on engagements.
Full version reserved for engagements. The detailed framework, the mapping and the six generators are used as part of an assessment or a support engagement.
Contact me →