0

I recently ran a couple of security audits for some friends, and was thinking about doing some more. Before I do though, I wanted to know whether I should keep the audit reports and, if so, how? I understand that it's insecure to keep it, but at the same time, what happens if the client loses the files/report and needs new copies?

  • 1
    We can't answer the legal question – schroeder Aug 19 '19 at 19:43
3

It depends on what your friends agreed to.

The fact that you did an audit for them implies that they are alright with you gaining knowledge of their system. Wether or not you are allowed to store that knowledge in some way for a prolonged period of time is something they must agree to explicitly.

You can state how you store the data (e.g. in an encrypted format, with the encryption key escrowed to a trusted third party, perhaps), and how you intend to use it.

However, keep in mind that I am not a lawyer, and if in doubt, you should always consult a lawyer for legal questions. They are much better equipped to talk about the laws in your specific region.

Why would you want to keep the audit report

As for usefulness, it certainly does have its uses. Most importantly, it gives you a quick overview over flaws you have found previously. This allows you to check if these specific flaws have been fixed since the last audit, or if there is still room for improvement.

It can also aid as a guide to see if your customer is heading in the right direction, or if they favor functionality over security - in which case you can definitely add to the audit that things had gotten worse since the last audit.

Keeping the audit in case the customer loses it is not really a valid use-case. Once you sent the customer the audit and they are happy with it, you did your job. It's up to them to keep their files safe, so if they lose it, it's not really your responsibility to provide them a copy. It's similar to how it's not the fault of the grocery store if you drop something in the parking lot and break it. (Of course, it's not unwise to provide them with a copy if they ask for it, but it shouldn't be your primary concern.)

  • I don't know that I agree that the customer must explicitly agree to the auditor keeping the audit. Laws vary across the world, and I wouldn't assume either case. – Steve Sether Aug 19 '19 at 19:50
  • @SteveSether Yes, it's entirely plausible that things are different in the US. At least here, you need to consent to such data being stored. – MechMK1 Aug 20 '19 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.