Audit bezpečnosti informačních systém

The master’s thesis analyzes the procedures, methods, and tools used in information systems security audits, with a special focus on personnel aspects and compliance. The aim of the thesis is to verify how employees’ practices and behaviors align with defined internal policies and legislative requirements (NIS2, the Cybersecurity Act, GDPR) and to identify weaknesses related to the human factor. The theoretical part summarizes key terms, standards (ISO/IEC 27001:2022, COBIT 2019), and relevant legislation. In the practical part, a gap audit was first conducted at the selected organization to assess compliance with the GDPR Regulation, the NIS2 Directive, and the Cybersecurity Act. This was followed by an audit carried out according to the company’s internal rules and the reference frameworks of ISACA, ISO/IEC 27001, and COBIT 2019. The audit combined document reviews, interviews, observations, and a Risk & Control Matrix (RACM) for mapping risks and controls. The results revealed an insufficient level of compliance in the areas examined. On the basis of the deficiencies identified, the thesis proposes a set of measures to increase the efficiency of the audit process, strengthen the security culture, and reduce human-factor risks.