Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Why Partnership Between the CISO and Internal Audit Is Critical To Achieving Cyber Resilience

Most security leaders look at Internal Audit as performing assessments or investigations and looking for deficiencies with a set due date and time. But today, internal audits are a continuous lifecycle. Internal Audit is constantly evaluating controls – even when it's the off-cycle for audits – to ensure controls are properly designed, operating effectively and the right people are in the right roles to perform the control activities.

A Shift In Relationship Mindset

The relationship between the CISO and Internal Audit can easily be a strained one. Internal Audit can oftentimes be seen as internal affairs at a police station – waiting to catch a slip-up, bringing on a forced discussion and a long list of remedial action items that take away from the day-to-day priorities.

But at Trustwave, CISO David Bishop and Vice President of Internal Audit Mark Domzal have flipped the script and embraced a shift in relationship mindset. That shift has led to a successful partnership with a common goal – protecting critical data and systems with the resources they have available at all costs.

We sat down with David and Mark to discuss how a strong relationship between the Office of the CISO and Internal Audit benefits the security of a company and its customers.

Talk to us about how you see the role of the Office of the CISO and cybersecurity structured – from the perspective of a leader for Internal Audit?

Mark: David and his team are constantly coming up with innovative ideas in an effort to optimize the organization's security posture. Emerging risk never sleeps – and we recognize that the Office of the CISO has to rapidly evolve in order to combat that.

If there are going to be changes made to the organization that will have a security or a fundamental technology impact, we're discussing those as a team to make sure that we're aligned and can keep up with that evolution from the audit side. We're also offering real-time advice from an internal controls and risk management perspective.

When I look at how cybersecurity should be structured, it's a three-layer of defense model. You have the business and cybersecurity solutions themselves as the first line of defense to manage risk and perform the internal controls; then you have the CISO and the information security team as the second line – advising management about proactive security strategies and how controls should be designed and operating. And as the third layer, you have Internal Audit as the independent assessment to ensure all three layers are in sync, effective and up to industry standards.

How does having a strong relationship with Internal Audit benefit the Office of the CISO?

David: With a strong relationship, you're able to get on the same page quicker. For example, if my team identifies a workflow problem, I can give that context to Mark, and we can begin a dialogue on how to solve it.

That joint dialogue is highly valuable in terms of advocating for investment in security – whether that's more people or technology. Audit results and Mark's opinion have been invaluable resources to drive security change within the organization. When we partner to deliver a consistent message about resource needs and how those resources fit into our audit and security strategies, it speeds up the decision processes both operationally as well as at the board level. We can get to deployment and 'securing' a lot quicker.

How does the relationship between Internal Audit and the CISO benefit the customer experience?

Mark: Supply chain risk is something that has really come to life over the past ten years and has reached critical mass with the SolarWinds breach.

When you're sharing information with a vendor, whether it's a third-party data center or a contractor, you're responsible for the risks associated with sharing sensitive data and, in many ways, the vendor that you're sharing critical data with.

Customers want to make sure that the sensitive information they're sharing is being handled correctly, that you have your own house in order, and are proactively managing third-party risks.

David: It's important to constantly communicate with customers about annual audits but also about the 'extra mile' security measures you are putting in place, like real-time monitoring of the security state of each vendor.

Our collective work with Internal Audit to achieve the highest standards possible and then go above and beyond the bar industry audit standards set requires maintaining the Center for Internet Security (CIS) best practices and an awareness that audit and compliance are the starting point, the minimum standard, so to speak.

For example, Trustwave maintains its SOC 2 Type 2, ISO 27001 certification and several other specialty certifications. It is currently pursuing ISO 9000 and 20000 certifications. These achievements are a result of the strong and fluid interaction between the Internal Audit team and the Information Security team. It's another great example of how a strong relationship between the two internal organizations can maintain operational velocity and provide enhanced value for customers.

For more information about technology and implementation offerings from Trustwave Consulting and Professional Services, visit:

Latest Trustwave Blogs

Trustwave Webinar: Getting Started with Microsoft Copilot for Security

As a Microsoft security partner, Trustwave has committed itself to helping clients get the most out of their Microsoft E5 license, including properly setting up one of E5's primary features -...

Read More

Think Pink

There are some people who say, "I already conduct red team exercises, why would I need something different that is nothing more than a watered-down red team?"

Read More

Unlock Zero Trust: Why Database Security is the Missing Piece

As organizations consider their journey to establishing a strong Zero Trust culture, they must adopt a data-centric approach, and this begins with ensuring database security.

Read More