{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T08:37:32Z","timestamp":1773391052347,"version":"3.50.1"},"reference-count":28,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2022,4,19]],"date-time":"2022-04-19T00:00:00Z","timestamp":1650326400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Applied Sciences"],"abstract":"<jats:p>Information security and cybersecurity management play a key role in modern enterprises. There is a plethora of standards, frameworks, and tools, ISO 27000 and the NIST Cybersecurity Framework being two relevant families of international Information Security Management Standards (ISMSs). Globally, these standards are implemented by dedicated tools to collect and further analyze the information security auditing that is carried out in an enterprise. The overall goal of the auditing is to evaluate and mitigate the information security risk. The risk assessment is grounded by auditing processes, which examine and assess a list of predefined controls in a wide variety of subjects regarding cybersecurity and information security. For each control, a checklist of actions is applied and a set of corrective measures is proposed, in order to mitigate the flaws and to increase the level of compliance with the standard being used. The auditing process can apply different ISMSs in the same time frame. However, as these processes are time-consuming, involve on-site interventions, and imply specialized consulting teams, the methodology usually adopted by enterprises consists of applying a single ISMS and its existing tools and frameworks. This strategy brings overall less flexibility and diversity to the auditing process and, consequently, to the assessment results of the audited enterprise. In a broad sense, the auditing needs of Small and Medium-sized Enterprises (SMEs) are different from large companies and do not fit with all the existing ISMSs\u2019 frameworks, that is a set of controls of a particular ISMS is not suitable to be applied in an auditing process, in an SME. In this paper, we propose a generic and client-centered web-integrated cybersecurity auditing information system. The proposed system can be widely used in a myriad of auditing processes, as it is flexible and it can load a set of predefined controls\u2019 checklist assessment and their corresponding mitigation tasks\u2019 list. It was designed to meet both SMEs\u2019 and large enterprises\u2019 requirements and stores auditing and intervention-related data in a relational database. The information system was tested within an ISO 27001:2013 information security auditing project, in which fifty SMEs participated. The overall architecture and design are depicted and the global results are detailed in this paper.<\/jats:p>","DOI":"10.3390\/app12094102","type":"journal-article","created":{"date-parts":[[2022,4,19]],"date-time":"2022-04-19T22:07:26Z","timestamp":1650406046000},"page":"4102","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":18,"title":["A Client-Centered Information Security and Cybersecurity Auditing Framework"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3448-6726","authenticated-orcid":false,"given":"M\u00e1rio","family":"Antunes","sequence":"first","affiliation":[{"name":"Computer Science and Communication Research Centre (CIIC), School of Technology and Management, Polytechnic of Leiria, 2411-901 Leiria, Portugal"},{"name":"INESC TEC, CRACS, 4200-465 Porto, Portugal"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1212-7864","authenticated-orcid":false,"given":"Marisa","family":"Maximiano","sequence":"additional","affiliation":[{"name":"Computer Science and Communication Research Centre (CIIC), School of Technology and Management, Polytechnic of Leiria, 2411-901 Leiria, Portugal"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0438-9119","authenticated-orcid":false,"given":"Ricardo","family":"Gomes","sequence":"additional","affiliation":[{"name":"School of Technology and Management, Polytechnic of Leiria, 2411-901 Leiria, Portugal"}]}],"member":"1968","published-online":{"date-parts":[[2022,4,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1504\/IJCIS.2020.107265","article-title":"Information technology governance and cybersecurity at the board level","volume":"16","year":"2020","journal-title":"Int. J. Crit. Infrastruct."},{"key":"ref_2","unstructured":"(2022, March 29). ENISA Threat Landscape\u20142020. Available online: https:\/\/www.enisa.europa.eu\/topics\/threat-risk-management\/threats-and-trends\/."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1125","DOI":"10.1177\/0263774X15610058","article-title":"The wealth of regions: Quality of government and SMEs in 172 European regions","volume":"33","author":"Nistotskaya","year":"2015","journal-title":"Environ. Plan. C Gov. Policy"},{"key":"ref_4","unstructured":"Street, D., Albu, C., Albu, N.W., and Webber, S.S. (2019). The SMP of the Future in a Changing World, Edinburgh Group."},{"key":"ref_5","unstructured":"(2022, March 29). SME Definition. Available online: https:\/\/ec.europa.eu\/growth\/smes\/sme-definition_en."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Ozkan, B.Y., and Spruit, M. (2021). Cybersecurity Standardisation for SMEs: The Stakeholders\u2019 Perspectives and a Research Agenda. Research Anthology on Artificial Intelligence Applications in Security, IGI Global.","DOI":"10.4018\/978-1-7998-7705-9.ch056"},{"key":"ref_7","unstructured":"(2022, March 29). ISO 27K Forum\u2014ISO 27001 ToolKit. Available online: https:\/\/www.iso27001security.com\/html\/toolkit.html."},{"key":"ref_8","unstructured":"(2022, March 29). NIST\u2014Cybersecurity Framework Reference Tool, Available online: https:\/\/www.nist.gov\/cyberframework\/nist-cybersecurity-framework-csf-reference-tool."},{"key":"ref_9","unstructured":"(2022, March 29). ISO 22301:2012 Societal Security\u2014Business Continuity Management Systems. Available online: https:\/\/www.iso.org\/standard\/50038.html."},{"key":"ref_10","unstructured":"(2022, March 29). Health Insurance Portability and Accountability Act of 1996, Available online: https:\/\/www.cdc.gov\/phlp\/publications\/topic\/hipaa.html."},{"key":"ref_11","unstructured":"(2021, April 18). ISO\u2014ISO\/IEC 27001:2013\u2014Information Technology\u2014Security Techniques\u2014Information Security Management Systems\u2014Requirements. Available online: https:\/\/www.iso.org\/standard\/54534.html."},{"key":"ref_12","unstructured":"(2022, March 29). Mango\u2014Limited Mango. Available online: https:\/\/www.mangolive.com\/."},{"key":"ref_13","unstructured":"(2022, March 29). ISO Manager\u2014ISO Manager. Available online: https:\/\/www.isomanager.com\/."},{"key":"ref_14","unstructured":"(2022, March 29). Instant Management Systems B.V.\u2014Instant 27001. Available online: https:\/\/instant27001.com\/."},{"key":"ref_15","unstructured":"(2022, March 29). Resolver\u2014IT Compliance. Available online: https:\/\/www.resolver.com\/lp\/g\/it-compliance\/."},{"key":"ref_16","unstructured":"(2022, March 29). OpensourceGRC\u2014ISO 27001 Package. Available online: https:\/\/www.opensourcegrc.org\/compliance-requirements?main=3."},{"key":"ref_17","unstructured":"(2022, March 29). Eramba\u2014GRC Software. Available online: https:\/\/www.eramba.org\/documentation."},{"key":"ref_18","unstructured":"(2022, March 29). SecuraStar\u2014ISO 27001 Software. Available online: https:\/\/www.securastar.com\/iso-27001-software.php."},{"key":"ref_19","unstructured":"(2022, March 29). Advisera\u2014Conformio. Available online: https:\/\/advisera.com\/conformio\/."},{"key":"ref_20","unstructured":"(2022, March 29). Netwrix\u2014ISO IEC Compliance. Available online: https:\/\/www.netwrix.com\/ISO_IEC_Compliance.html."},{"key":"ref_21","unstructured":"(2022, March 29). Certikit\u2014ISO 27001 ToolKit. Available online: https:\/\/certikit.com\/products\/iso-27001-toolkit\/."},{"key":"ref_22","unstructured":"(2022, March 29). IT Governance ISO 27001 Documentation Tool Kit. Available online: https:\/\/www.itgovernance.co.uk\/iso27001_toolkits."},{"key":"ref_23","unstructured":"(2022, March 29). Teramind\u2014ISO 27001 Compliance. Available online: https:\/\/www.teramind.co\/solutions\/compliance\/ISO27001."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"219","DOI":"10.3390\/jcp1020012","article-title":"Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal","volume":"1","author":"Antunes","year":"2021","journal-title":"J. Cybersecur. Priv."},{"key":"ref_25","first-page":"26","article-title":"A description of the model-view-controller user interface paradigm in the smalltalk-80 system","volume":"1","author":"Krasner","year":"1988","journal-title":"J. Object Oriented Program."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"45201","DOI":"10.1109\/ACCESS.2021.3066348","article-title":"Classifying Model-View-Controller Software Applications Using Self-Organizing Maps","volume":"9","author":"Delgado","year":"2021","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Valarezo, R., and Guarda, T. (2018, January 13\u201316). Comparative analysis of the laravel and codeigniter frameworks: For the implementation of the management system of merit and opposition competitions in the State University Pen\u00ednsula de Santa Elena. Proceedings of the 2018 13th IEEE Iberian Conference on Information Systems and Technologies (CISTI), Caceres, Spain.","DOI":"10.23919\/CISTI.2018.8399242"},{"key":"ref_28","first-page":"704","article-title":"A comparative study of laravel and symfony PHP frameworks","volume":"9","author":"Laaziri","year":"2019","journal-title":"Int. J. Electr. Comput. Eng."}],"container-title":["Applied Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2076-3417\/12\/9\/4102\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:56:32Z","timestamp":1760136992000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2076-3417\/12\/9\/4102"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,19]]},"references-count":28,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2022,5]]}},"alternative-id":["app12094102"],"URL":"https:\/\/doi.org\/10.3390\/app12094102","relation":{},"ISSN":["2076-3417"],"issn-type":[{"value":"2076-3417","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4,19]]}}}