Published: 13 June 2024
有效的安全审计可加强企业机构的安全态势，为关键的安全流程和控制措施提供鉴证。本文介绍了首席信息安全官（CISO）等网络安全领导者在安全审计期间可以采用的最佳实践。
企业机构正面临越来越多的安全审计，需要投入资源，而这些资源本可用于业务和IT流程的运行、维护和监控。
不遵循审计计划，不重视与审计人员的透明、有效沟通，会影响为满足审计要求而进行的资源调配，以及审计发现的准确性。
审计发现是持续改善企业机构安全态势的重要工具，可为企业领导层提供网络风险管理妥当的鉴证。
在安全审计期间，首席信息安全官（CISO）等网络安全领导者及其团队应：
指派一名干练的审计联络员或从企业机构内部选出联络小组，集中处理和协调审计人员提出的所有要求，此举有助于维持正常的业务运营。
充分准备并遵循商定的审计计划和时间表，避免意外和障碍。
在公布审计报告前，阅读审计报告，接受事实，不接受过度概括，与审计人员进行明确、建设性的沟通，以最大程度地发挥审计发现的有效性。
Clients can log in to view the entire document.
Analysts:
Gartner research, which includes in-depth proprietary studies, peer and industry best practices, trend analysis and quantitative modeling, enables us to offer innovative approaches that can help you drive stronger, more sustainable business performance.
Our independence as a research firm enables our experts to provide unbiased advice you can trust.
Not only is Gartner research unbiased, it also contains key take-aways and recommendations for impactful next steps.
Our research practices and procedures distill large volumes of data into clear, precise recommendations.
We provide actionable, objective insight to help organizations make smarter, faster decisions to stay ahead of disruption and accelerate growth.
We offer one-on-one guidance tailored to your mission-critical priorities.
We work with you to select the best-fit providers and tools, so you avoid the costly repercussions of a poor decision.
Connect directly with peers to discuss common issues and initiatives and accelerate, validate and solidify your strategy.
Gartner clients can log in to access the full library.
Attend a Conference
Experience Information Technology conferences
With exclusive insights from Gartner experts on the latest trends, sessions curated for your role and unmatched peer networking, Gartner conferences help you accelerate your priorities.
Gartner CIO & IT Executive Conference
São Paulo, Brasil
© 2026 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. It consists of the opinions of Gartner's business and technology insights organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner business and technology insights may address legal and financial issues, Gartner does not provide legal or investment advice and its insights should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its insights are produced independently by its business and technology insights organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity. Gartner publications and other content may not be used as input into or for the training or development of generative artificial intelligence, machine learning, algorithms, software or related technologies.
