Building Your 2026 Cybersecurity Audit Plan

Why It Matters

A modern, balanced audit plan equips leaders with actionable risk insights, protecting mission outcomes and building board confidence in an increasingly complex threat landscape.

Key Takeaways

• Align 2026 audit plan with evolving SaaS, cloud, AI risks.
• Prioritize safeguard validation to identify gaps threatening mission success.
• Balance legacy controls with emerging technologies for comprehensive coverage.
• Use board presentations to translate technical findings into business impact.
• Foster feedback loops with community to continuously improve audit processes.

Summary

James Trella, a veteran SANS instructor and cyber‑risk specialist, opened the webcast by framing the 2026 cybersecurity audit plan as a strategic imperative for any organization seeking to protect its mission. He highlighted his decades of experience authoring CIS Controls and conducting assessments at Cyarity, positioning the session as a practical guide for auditors, GRC teams, and board‑level stakeholders preparing their annual audit roadmaps. The core of the discussion centered on safeguard validation: auditors must identify missing controls that could let threats materialize. Trella warned against the complacency of repeatedly auditing the same legacy domains—such as identity and access—while neglecting newer vectors like SaaS, cloud-native services, DevOps pipelines, and AI‑driven threats. He advocated a balanced scope that blends traditional controls with emerging technology risks, ensuring comprehensive assurance for executives. A memorable analogy compared early‑era “wizards”—single experts who manually defended networks—to today’s data‑scientist‑style teams that rely on standardized, measurable safeguards. Trella emphasized that the art of cybersecurity is shrinking as frameworks become more definitive, and auditors now have the tools to measure “what good looks like.” He also stressed the importance of a two‑way feedback loop with the broader SANS community to refine audit practices continuously. The takeaway for businesses is clear: a forward‑looking, data‑driven audit plan not only satisfies compliance requirements but also translates technical risk into business language that boards can act on. By integrating emerging tech considerations, maintaining legacy oversight, and fostering community input, organizations can improve risk visibility, allocate resources more effectively, and strengthen overall mission resilience.

Original Description

As organizations prepare for 2026, security leaders face a challenging audit environment shaped by new regulations, updated standards, and an evolving threat landscape. Audit programs are expected to do more than simply check compliance boxes—they must provide meaningful assurance that cybersecurity safeguards are operating effectively and aligned with business priorities. Too often, audit plans are built reactively, repeating last year’s scope or relying on external checklists, rather than taking a forward-looking approach tied to risk and governance.

In this webcast, SANS Senior Instructor James Tarala will provide a practical framework for designing a cybersecurity audit plan that is both strategic and actionable. He will highlight the latest changes in regulatory expectations and standards requirements, examine how those shifts influence auditor focus areas, and explain how organizations can prepare for new areas of scrutiny.

The discussion will also connect audit activities to the broader governance and risk roadmap, ensuring that audit plans support—not distract from—the organization’s overall security strategy. Attendees will learn how to build an audit roadmap that reflects organizational risk priorities, maximizes the use of available resources, and ensures coverage across the most important safeguards. The webcast will emphasize how a well-constructed audit plan can provide real value beyond compliance, strengthening assurance, identifying gaps before adversaries do, and reinforcing confidence with executives and stakeholders.

Learning Objectives:

- Identify the regulatory, standards, and threat-driven factors that should shape a 2026 audit plan

- Build an audit roadmap that aligns with organizational risk priorities and available resources

- Apply practical techniques to ensure audits provide real value beyond compliance checkboxes

Learn more about James, https://www.sans.org/profiles/james-tarala

This session supports concepts from LDR519: Cybersecurity Governance, Risk, and Compliance (GRC). To learn more about this course, explore upcoming sessions, and access your FREE preview, visit https://go.sans.org/ZcvAu3

#CybersecurityAudit #Cybersecurity #Audit #InfoSec