Information Technology Risk & Control Services

Information Technology Risk, Control and Assurance Services

IT Check – Information Technology Risk, Control and Assurance Assessment

We assess companies’ information technology infrastructure, corporate data assets and digital working environments from an independent risk, control and assurance perspective.

The purpose of the engagement is not to replace existing systems or promote the purchase of a particular technology product. The current environment is analyzed, the design and operating effectiveness of controls are assessed, identified risks are classified, and management is provided with an IT Risk and Control Report containing prioritized improvement recommendations.

• CIS Controls v8: Critical security controls and technical security practices
• ISO/IEC 27001:2022: Information security management systems and information security controls
• COBIT: IT governance, control and risk management
• NIST Cybersecurity Framework (CSF): Identification, protection, detection, response and recovery relating to cybersecurity risks
• KVKK Technical Measures: Technical and organizational measures relating to the protection of personal data
• NIST AI RMF and ISO/IEC 42001: Artificial intelligence use, governance and associated data security risks
• CIS Benchmarks and cloud security good practices: Security configurations for Microsoft 365, Azure, AWS, Google Workspace and similar environments

Approach: These frameworks are not used for certification purposes. They are used to assess the existing control environment, identify control gaps and map findings to objective criteria.

1 IT Asset and Inventory Management Controls

Reference: CIS Controls | ISO/IEC 27001

Visibility over desktops, laptops, servers and related software assets used within the organization is assessed.

The review includes;

• inventory of devices and hardware,
• operating system and software distributions,
• unauthorized or unmanaged software,
• applications that may create security risks,
• outdated or unmanaged systems,
• license and usage visibility,
• differences between formal IT inventory records and actual use

2 Data Loss Prevention and Data Security Controls – DLP Check

Reference: CIS Controls | ISO/IEC 27001

Risks relating to corporate data being transferred outside the organization by employees, applications or external devices are assessed.

The review particularly considers;

• use of USB and external storage devices,
• ability to copy files outside the organization,
• uploading sensitive data through web applications,
• data exfiltration via e-mail,
• clipboard/copy-and-paste activities,
• uncontrolled transfer of data to cloud storage,
• uncontrolled transfer of corporate data outside the organization,
• the scope and operating effectiveness of existing DLP policies

3 KVKK and Sensitive Data Controls

Reference: KVKK Technical Measures | ISO/IEC 27001

Risks arising from sensitive or personal data stored without adequate controls on company devices, shared folders and other data environments within the agreed scope are assessed.

Examples include;

• Turkish Republic identification numbers,
• IBAN information,
• credit card information,
• passport information,
• customer and employee personal data,
• payroll and financial information,
• contracts,
• files containing usernames and passwords,
• API keys, tokens and similar access credentials

This assessment supports the evaluation of the company’s existing technical and organizational measures under the Turkish Personal Data Protection Law (KVKK).

4 Critical File Integrity and Unauthorized Access Controls

Reference: CIS Controls | ISO/IEC 27001

The protection level of critical corporate files and folders is assessed.

• ability to make unauthorized changes to critical files,
• deletion or modification of files,
• users accessing information they should not be authorized to view,
• ability to transfer critical files outside the organization,
• whether file integrity is monitored,
• authorization structures for critical shared locations

Critical data areas such as accounting, finance, human resources, customer data and management documents may be prioritized.

5 Identity, Access and Privileged Account Management – IAM / PAM

Reference: CIS Controls | ISO/IEC 27001 | COBIT

One of the fundamental information security risks is users having broader access rights than required for their responsibilities.

Within the scope of IT Check;

• administrator and privileged accounts,
• user access levels,
• high-privilege accounts such as Domain Admin / Global Admin,
• shared accounts,
• accounts belonging to former employees,
• unused accounts,
• MFA usage,
• third-party access,
• over-privileged users,
• implementation of the Least Privilege principle

6 Microsoft 365 and Google Workspace Security Controls

Reference: CIS Benchmarks | ISO/IEC 27001

Security and sharing configurations within cloud-based working environments are assessed.

Within Microsoft 365 and Google Workspace environments;

• accounts without MFA,
• privileged/administrator accounts,
• external sharing links,
• anonymous or uncontrolled sharing capabilities,
• incorrect file and folder sharing permissions,
• third-party application and OAuth permissions,
• unused or unmanaged user accounts,
• over-privileged users,
• baseline security policies and configurations

7 Cloud Infrastructure and SaaS Security Controls

Reference: ISO/IEC 27017 | CIS Cloud Benchmarks

Baseline security and access configurations of cloud services and SaaS applications used by the company are assessed.

Depending on the technology environment and level of access provided;

• Microsoft Azure,
• Amazon Web Services (AWS),
• Google Cloud Platform (GCP),
• Microsoft 365,
• Google Workspace

and similar environments may be reviewed for publicly accessible data locations, internet-facing resources, over-privileged accounts, misconfigured access permissions, IAM configurations and in-scope API/service access rights.

8 Artificial Intelligence Risk and Data Security Governance

Reference: NIST AI RMF | ISO/IEC 42001

The use of generative artificial intelligence is assessed not only from a technical data leakage perspective, but also from a corporate governance and control perspective.

The assessment may include;

• whether a corporate artificial intelligence usage policy exists,
• which AI services employees are permitted to use,
• whether data categories that may or may not be transferred to AI platforms have been defined,
• rules governing the protection of customer data, financial information, contracts and other critical content,
• approved and uncontrolled AI usage channels,
• existing technical blocking, filtering and monitoring mechanisms,
• the extent to which roles, authorities and responsibilities for artificial intelligence use have been defined

This enables management to focus on an understandable action plan showing which risks matter, why they matter and which actions should be addressed first, rather than reviewing hundreds of technical data points.

Note: The maturity assessment is not a certification result. It is a management indicator designed to help management understand the current control level and identify target areas for improvement.

• the organization’s current IT Risk Profile,
• Critical / High / Medium / Low risk classification,
• Impact × Likelihood assessment,
• a 1–5 Control Maturity Level for key control areas,
• mapping of findings to relevant standards and control frameworks,
• a prioritized remediation and action plan

The purpose of Erta IT Check is not to sell any particular software or technology product.

The purpose of the engagement is to assess the company’s existing information technology environment from an independent risk and control perspective, identify control weaknesses and potential risks, and develop practical recommendations to address those risks.

The technology used is a measurement and analysis tool supporting the assessment; it is not the audit conclusion itself.

Our core question is:

“If the company’s devices, data, users, cloud systems and digital working environments were independently assessed from a risk and control perspective today, what risks would be identified?”