Government Accountability Office’s Cybersecurity Program Audit Guide (CPAG)

This presentation will focus on the origin of the CPAG and how individuals and auditors can use it when planning for and conducting cybersecurity-related performance audits. Attendees will gain a foundational understanding of the guide’s recommended methodologies and techniques for conducting audits and learn how they can use or tailor it to meet their specific needs.  CPAG’s six primary components are as follows:

1. Asset and Risk Management
2. Configuration Management
3. Identity and Access Management
4. Continuous Monitoring and Logging
5. Incident Response
6. Contingency Planning and Recovery