Building Ethiopia’s Digital Resilience
Article 5: Cybersecurity Audit — Building Trust Rather Than Fear
“A good cybersecurity audit should not simply tell us what is wrong. It should help us understand risk, build trust and become more resilient.”
In the previous article, we discussed one of Ethiopia’s most important cybersecurity challenges: capacity. Technology is important, but technology alone cannot protect critical infrastructure. We need skilled professionals, capable leaders, strong institutions, continuous learning and a professional community that can turn knowledge into real capability.
This leads us to another important question. How do we know that the security measures we put in place are actually working?
An organization may have cybersecurity policies. It may have firewalls, monitoring systems, access controls, backups and incident response plans. Employees may have received security training. Management may receive regular cybersecurity reports. But having these things does not automatically mean they are effective. A backup may exist but fail when recovery is needed. A security policy may be well written but not followed. A monitoring system may generate thousands of alerts while serious threats remain unnoticed. An incident response plan may look excellent on paper but fail during a real emergency. A supplier may promise strong security without providing enough evidence. This is where cybersecurity audit and independent assurance become important.
An audit gives an organization an opportunity to examine its cybersecurity controls systematically and ask a simple but important question:
Are we really as secure and prepared as we believe we are?
That question should be at the heart of cybersecurity auditing. Ethiopia’s Critical Infrastructure Cybersecurity Proclamation gives cybersecurity assurance and oversight an important place within the protection of critical infrastructure. Its broader purpose is not simply to require organizations to have security controls, but to reduce cyber risks, establish responsibilities and strengthen the resilience of services that the country depends on.
The operational blueprint also places audit and assurance within the wider governance framework for critical infrastructure protection. This creates an important opportunity for Ethiopia. But it also creates responsibility.
If cybersecurity audit is implemented mainly as a way to find faults and punish organizations, organizations may begin to fear the audit process. When people fear audits, they may focus on preparing documents rather than improving security. They may try to show auditors what they believe auditors want to see instead of openly discussing weaknesses. That would be a missed opportunity. A strong audit culture should encourage organizations to identify problems before attackers identify them.
Finding a weakness during an audit is much better than discovering the same weakness during a cyberattack.
Audit should create assurance, not an illusion of security. Passing an audit does not mean an organization cannot be attacked. This is important to understand. Cybersecurity audit provides assurance based on evidence available at a particular time and within an agreed scope. Cyber threats, technologies and organizations continue to change after the audit is completed.
An audit report should therefore never create the impression that an organization is permanently secure. Instead, it should help management understand whether important risks are being managed properly, whether controls are working as expected and where improvement is required. This connects directly with the distinction we discussed earlier in this series between compliance and resilience.
Compliance may ask:
“Do you have an incident response plan?”
A resilience-focused audit should go further:
“Has the plan been tested, did it work, what did you learn, and can you actually respond when a serious incident happens?”
Compliance may ask:
“Do you have backups?”
A stronger audit asks:
“Can you restore your critical services from those backups within the time your organization needs?”
Compliance may ask:
“Do employees receive cybersecurity training?”
A stronger audit asks:
“Do employees understand the cyber risks connected to their work, and has their behavior improved?”
The difference is important. The first approach checks whether something exists. The second asks whether it works. For critical infrastructure, we need both.
Independence is essential
An auditor must be able to report what the evidence shows, even when the finding is uncomfortable. This requires independence.
If an auditor is pressured to remove a serious finding because management does not want to see it in the report, the value of the audit is weakened.
If a cybersecurity company sells a security solution and then independently audits its own implementation without properly managing that conflict, important questions about objectivity arise.
If an auditor is afraid that reporting serious weaknesses will damage a commercial relationship, independence may again be affected.
This does not mean that every possible relationship automatically makes an audit invalid. It means that conflicts of interest must be identified, understood and managed transparently.
For critical infrastructure, this becomes especially important because audit results may influence decisions affecting essential national services.
An auditor's responsibility is therefore not to make management happy. It is to provide fair, evidence-based professional assurance.
Ethics must come before access
Cybersecurity auditors can receive extraordinary access to an organization. They may see network designs, system configurations, security weaknesses, access controls, business processes, personal information, incident records and sometimes highly sensitive information about critical infrastructure.
That access creates responsibility. An auditor who discovers a serious vulnerability must protect that information carefully. Audit information should not be discussed casually. It should not be used for personal advantage. It should not be shared with people who have no legitimate reason to receive it. And a vulnerability discovered during an audit should never become an opportunity for commercial pressure. This is why cybersecurity auditing requires more than technical knowledge. It requires professional ethics. Integrity, confidentiality, objectivity, competence and professional care are not additional qualities that we can consider later. They are part of the foundation of trustworthy auditing.
Trust can take years to build and minutes to destroy.
The auditor must understand what is being audited. Cybersecurity has become too broad for one person to be an expert in everything. Auditing a bank may require knowledge of financial systems, identity management, cloud environments, payment infrastructure and regulatory requirements.
Auditing a hospital may require understanding healthcare systems, sensitive health information and the operational importance of clinical services. Auditing electricity infrastructure may require knowledge of operational technology and industrial control systems. A general IT auditor should therefore not automatically be considered qualified to audit every type of critical infrastructure.
The audit team must have expertise appropriate to the environment being assessed. Sometimes that means combining different professionals. An experienced information systems auditor may lead the assurance process while cybersecurity specialists examine technical controls. An operational technology specialist may be required for industrial systems. Legal or privacy expertise may be needed when the audit touches sensitive information or regulatory obligations. This multidisciplinary approach is particularly important as Ethiopia develops its critical infrastructure assurance capability. Professional qualifications can support this process, but qualifications alone are not enough.
An auditor needs education, practical experience, professional judgement and continuous learning. This is also where professional associations such as the Ethiopian Information Systems Audit Association (EISAA) can contribute by creating awareness, supporting continuous professional education, strengthening professional ethics and competence, bringing experts together, and creating a professional platform where practitioners can contribute to discussions about cybersecurity assurance and critical infrastructure protection.
Building this professional community matters because the quality of national cybersecurity assurance ultimately depends on the quality and integrity of the people performing it.
Audit should be based on evidence.
Cybersecurity audit should not be based mainly on opinion. An auditor needs evidence. If an organization says that access to critical systems is reviewed regularly, the auditor should be able to examine evidence showing that the reviews actually happen. If management says backups are tested, there should be evidence of recovery testing. If incidents are supposed to be reported and investigated, records should demonstrate how that process works. If employees receive security training, the audit should examine not only whether training took place but also whether the program is appropriate for the risks people face. This makes audit more objective. It also protects both sides. The organization can demonstrate what it has done, and the auditor can explain clearly why a finding was made.
A good audit finding should therefore not simply say: “Security is weak.” It should explain what was observed, why it matters, what risk it creates and what improvement is needed.
This turns audit findings into useful management information.
Not every weakness has the same importance
Critical infrastructure audits must also be risk-based. Imagine an audit identifies fifty findings. One organization may focus on closing as many findings as possible so that the number becomes smaller. But what if one of those fifty findings could interrupt a nationally important service while twenty others create relatively minor risks? Counting findings alone tells us very little.
The important question is:
Which weaknesses could cause the greatest harm?
This is why audit findings need to be understood in relation to business and operational risk. A technical vulnerability becomes much more meaningful when management understands what it could affect.
Could it interrupt electricity?
Could it expose customer information?
Could it stop financial transactions?
Could it affect patient care?
Could it allow an attacker to move into more important systems?
Could it create a path to another critical organization?
This is how cybersecurity audit connects technical findings with organizational and national resilience.
The regulator and the auditor should not become the same thing
As Ethiopia develops the implementation model around the proclamation, another distinction will be important. Regulation, independent assurance and operational cybersecurity support serve different purposes.
INSA has an important national role in setting expectations, providing oversight, coordinating national cybersecurity and taking appropriate regulatory action.
Independent auditors provide assurance.
Cybersecurity service providers may help organizations implement and operate security controls.
These roles can support each other, but their responsibilities should remain clear. A healthy ecosystem should allow independent professional assurance to develop alongside regulatory oversight. That creates more capacity and can also strengthen trust.
Findings should lead to improvement
The audit report should not be the end of the audit. It should be the beginning of improvement.
Management should understand the findings, agree on priorities, assign responsibility and follow corrective actions until important risks are properly addressed. Some weaknesses may be corrected quickly. Others may require major technology changes, investment or long-term programs. The objective should not be to hide this reality. It should be to understand it and manage the risk responsibly.
The next audit should then be able to ask:
What has improved?
What remains open?
Why?
Has the risk changed?
Have new risks appeared?
This creates a cycle of continuous improvement.
Assess. Understand. Improve. Verify. Learn. Repeat.
That is much more valuable than treating an audit as an event that happens once a year.
Building a culture where people can speak about weaknesses
Perhaps one of the most important outcomes Ethiopia can build is a culture where identifying a cybersecurity weakness is seen as responsible behavior rather than failure. If an employee reports a mistake early, the organization may be able to prevent an incident. If a security professional identifies a vulnerability, it can be corrected. If an auditor reports a serious control weakness, management can address it. If an organization reports an emerging threat, other critical infrastructure operators may be able to protect themselves.
Silence is often more dangerous than the weakness itself. This does not mean removing accountability. Negligence, repeated failure to address serious risks or deliberate disregard of security responsibilities may require regulatory action. But there is an important difference between accountability and fear. Accountability encourages responsible behavior.
Fear encourages people to hide problems. For cybersecurity, we need the first.
Audit should ultimately build trust
A good cybersecurity audit creates value for many people. It gives management better information for making decisions. It gives regulators greater confidence that critical infrastructure risks are being managed. It gives customers and partners greater trust in the organization. It helps cybersecurity teams identify where improvement is needed. And at national level, it provides another layer of assurance that the services society depends on are being protected responsibly. This is why cybersecurity auditing should not become simply another compliance industry created by the proclamation. It should become part of Ethiopia's national resilience capability. That will require competent auditors, strong professional ethics, clear standards, independence, risk-based thinking and continuous professional development. It will also require dialogue.
Auditors need to understand the organizations they assess. Critical infrastructure owners need to understand what regulators and auditors expect. INSA needs feedback about how requirements work in practice. Private cybersecurity professionals and professional associations need opportunities to contribute their experience. The system will improve through this interaction.
The proclamation gives Ethiopia an important starting point. The assurance model that develops around it should now aim for something larger than passing audits.
It should help organizations become safer.
It should help leaders understand risk.
It should help professionals improve.
And it should help build trust between government, critical infrastructure owners, the private sector and the people who depend on these services.
But even an organization with strong internal security and excellent audit results can still be exposed through someone else.
Its cloud provider.
Its software supplier.
Its telecommunications provider.
Its equipment manufacturer.
Its contractors.
Or even a small technology company connected to its systems.
That brings us to the next part of our journey.
Article 6 — Beyond Firewalls: Supply Chain Security and Trust in the Digital Economy.
Because in a connected digital nation, we are not protected only by how secure we are. We are also affected by how secure the organizations we depend on are.
Comments