Is it ok and useful to keep a security audit report after completing an audit?

Question

I recently ran a couple of security audits for some friends, and was thinking about doing some more. Before I do though, I wanted to know whether I should keep the audit reports and, if so, how? I understand that it's insecure to keep it, but at the same time, what happens if the client loses the files/report and needs new copies?

Answer 1

It depends on what your friends agreed to.

The fact that you did an audit for them implies that they are alright with you gaining knowledge of their system. Wether or not you are allowed to store that knowledge in some way for a prolonged period of time is something they must agree to explicitly.

You can state how you store the data (e.g. in an encrypted format, with the encryption key escrowed to a trusted third party, perhaps), and how you intend to use it.

However, keep in mind that I am not a lawyer, and if in doubt, you should always consult a lawyer for legal questions. They are much better equipped to talk about the laws in your specific region.

Why would you want to keep the audit report

As for usefulness, it certainly does have its uses. Most importantly, it gives you a quick overview over flaws you have found previously. This allows you to check if these specific flaws have been fixed since the last audit, or if there is still room for improvement.

It can also aid as a guide to see if your customer is heading in the right direction, or if they favor functionality over security - in which case you can definitely add to the audit that things had gotten worse since the last audit.

Keeping the audit in case the customer loses it is not really a valid use-case. Once you sent the customer the audit and they are happy with it, you did your job. It's up to them to keep their files safe, so if they lose it, it's not really your responsibility to provide them a copy. It's similar to how it's not the fault of the grocery store if you drop something in the parking lot and break it. (Of course, it's not unwise to provide them with a copy if they ask for it, but it shouldn't be your primary concern.)