IAMM Internal Audit Maturity Model

Foundations of confidentiality, integrity, and availability, plus risk frameworks that anchor every other domain.

Key topics

• CIA triad + security governance principles
• Compliance, legal & regulatory issues
• Professional ethics and codes of conduct
• Risk management concepts + threat modelling
• Security policies, standards, procedures, and guidelines

Classifying information assets and applying the right controls across the data lifecycle.

Key topics

• Information & asset classification
• Data owners, processors, and custodians
• Data lifecycle: collection, storage, disposal
• Asset retention requirements and data minimisation
• Data security controls + standards selection

Designing secure systems — from cryptographic primitives to secure architecture patterns.

Key topics

• Engineering processes using secure design principles
• Security models (Bell–LaPadula, Biba, Clark–Wilson)
• Cryptography: symmetric, asymmetric, hashing, PKI
• Vulnerabilities in web, mobile, cloud, IoT, ICS
• Physical security and site design

Network protocols, secure communications, and the topology decisions that determine your perimeter.

Key topics

• OSI / TCP-IP models and secure network components
• Secure communication channels (VPN, TLS, SD-WAN)
• Network attacks + mitigations
• Wireless, cellular, and satellite security
• Firewalls, IDS/IPS, NAC, and zero-trust networking

Who can do what, when, and how — the access control core every breach investigation comes back to.

Key topics

• Identification, authentication, authorisation, accountability
• Identity-as-a-service and federated identity (SAML / OIDC)
• Access control models (DAC / MAC / RBAC / ABAC)
• Privileged access management (PAM)
• Identity lifecycle and provisioning

Designing, performing, and analysing the assessments that prove your controls actually work.

Key topics

• Assessment, test, and audit strategies
• Vulnerability assessments + penetration testing
• Log management and SIEM correlation
• Code review and security control validation
• Security metrics + management reporting

Day-to-day operational security — detection, response, recovery, and the disciplined rituals around them.

Key topics

• Investigations and incident response lifecycle
• Logging, monitoring, and threat intelligence
• Vulnerability and patch management
• Disaster recovery + business continuity planning
• Physical security, personnel safety, and fire safety

Embedding security across the SDLC — from requirements to release and into post-deployment monitoring.

Key topics

• Security in the SDLC (Waterfall, Agile, DevSecOps)
• Secure coding standards + common vulnerabilities (OWASP Top 10)
• Application security testing (SAST, DAST, IAST, SCA)
• Software supply chain security
• Maturity models (BSIMM, SAMM) and assurance