IICTI Certified Security Compliance Auditor

Holders demonstrate that they can apply and evaluate risk-based audit programme management, multi-framework control mapping and rationalisation, iSMS certification auditing to ISO/IEC 27001:2022 and sOC 2 and ISAE 3402/3000 attestation engagements, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Security Compliance Auditor.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Risk-based audit programme management9% of the exam

   • Design and lead a risk-based security audit programme aligned to organisational risk and regulatory exposure.
   • Scope: ISO 19011:2018 and ISO/IEC 27007, IIA Global Internal Audit Standards (2024), audit universe and risk assessment, multi-year audit planning, audit team competence and resourcing.
2. 02Multi-framework control mapping and rationalisation10% of the exam

   • Evaluate overlapping frameworks and design a rationalised control set that supports test-once, comply-many assurance.
   • Scope: ISO/IEC 27001:2022 Annex A, NIST CSF 2.0, NIST SP 800-53 Rev. 5, CIS Controls v8.1, Secure Controls Framework, unified control sets and OSCAL-based mappings.
3. 03ISMS certification auditing to ISO/IEC 27001:20229% of the exam

   • Lead ISMS certification audits and grade nonconformities with sound, evidence-based judgement.
   • Scope: Clauses 4 to 10 and Annex A, ISO/IEC 27006-1:2024 and ISO/IEC 17021-1, stage 1 and stage 2 audits, Statement of Applicability evaluation, nonconformity grading, surveillance and recertification.
4. 04SOC 2 and ISAE 3402/3000 attestation engagements10% of the exam

   • Evaluate attestation scope, control descriptions and exceptions to form reliable assurance conclusions.
   • Scope: AICPA Trust Services Criteria with revised points of focus, SSAE 18 and ISAE 3402/3000, Type 1 versus Type 2, complementary user entity controls, inclusive and carve-out subservice organisations, bridge letters.
5. 05Control testing, sampling and evidence evaluation9% of the exam

   • Design control tests and sampling approaches that produce sufficient, reliable evidence for audit conclusions.
   • Scope: Test of design versus operating effectiveness, attribute and statistical sampling, CAATs and data analytics, IT general controls, evidence sufficiency, relevance and reliability, reperformance and walkthroughs.
6. 06Technical security control auditing in hybrid and cloud estates9% of the exam

   • Evaluate the operating effectiveness of technical security controls using system-generated evidence.
   • Scope: IAM and privileged access reviews, CIS Benchmarks configuration baselines, vulnerability and patch management, logging and monitoring, CSA CCM v4, cloud configuration evidence from CSPM, encryption and key management.
7. 07EU cybersecurity regulatory compliance auditing9% of the exam

   • Assess organisational compliance with EU cybersecurity regulations and map gaps to prioritised remediation.
   • Scope: NIS2 Article 21 measures and Implementing Regulation (EU) 2024/2690, DORA ICT risk, incident and TLPT requirements, GDPR Article 32, Cyber Resilience Act and EU AI Act intersections.
8. 08Payment and sector-specific security standards9% of the exam

   • Evaluate compliance with sector-specific standards, including scope validation and compensating or customised controls.
   • Scope: PCI DSS v4.0.1 including customised approach and targeted risk analysis, SWIFT CSCF, HIPAA Security Rule, ISO 22301 continuity requirements, scoping and segmentation validation.
9. 09Third-party and supply chain assurance9% of the exam

   • Design and audit third-party assurance programmes proportionate to supplier criticality and concentration risk.
   • Scope: Third-party risk management lifecycle, right-to-audit clauses, SIG and CAIQ questionnaires, DORA register of information and ICT third-party requirements, fourth-party risk, SBOM and continuous vendor monitoring.
10. 10Continuous controls monitoring and compliance automation9% of the exam

    • Architect continuous assurance capabilities and evaluate when automated evidence can be relied upon.
    • Scope: GRC platform design, OSCAL and compliance-as-code, automated evidence collection, continuous controls monitoring, KRIs and KCIs, reliance on automated controls and their validation.
11. 11Audit reporting, findings management and professional ethics8% of the exam

    • Lead audit reporting that communicates risk clearly and drives verified remediation while maintaining independence.
    • Scope: Root cause analysis, risk rating of findings, management action plans and follow-up, reporting to audit committees and boards, ISACA ITAF 4th edition, independence, objectivity and impartiality safeguards.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner