HomeResourcesInsights and ExpertiseWhite Papers
Insights and Expertise

White Papers

Find timely, relevant and practical information on issues that impact professionals like you. Download our expert-written, informative white papers on a variety of topics for free.

ISACA document titled "Designing Metrics That Support Better Decisions" with colorful abstract design.
Featured White Paper

Designing Metrics That Support Better Decisions

This white paper explains the differences between indicators, including KPIs, KRIs, and KCIs, how to design metrics that are less prone to misinterpretation, and how to ensure metrics are not used as a replacement for professional judgment.

Learn More

Browse All ISACA White Papers

Layout List Layout Card Layout

15 of 98 Results

ISACA document titled "Designing Metrics That Support Better Decisions" with colorful abstract design.
White Paper

Designing Metrics That Support Better Decisions

This white paper explains KPIs, KRIs, and KCIs, how to design metrics less prone to misinterpretation, and avoid replacing professional judgment.
Cybersecurity Recommendations for Securing AI Agents
White Paper

Cybersecurity Recommendations for Securing AI Agents

This paper provides a set of controls, a secure-by-default checklist, and a data classification and handling guide that can serve as important inputs when securing agentic AI.
Understanding the EU AI Act
White Paper

Understanding the EU AI Act: Requirements and Next Steps

The rapid growth in the use of artificial intelligence (AI) technologies, especially generative AI (genAI), is driven by the myriad benefits these technologies are purported to provide.
The Promise and Peril of the AI Revolution: Managing Risk
White Paper

The Promise and Peril of the AI Revolution: Managing Risk

This paper provides an overview of the major AI risk developments, governance expectations, and security realities that have emerged in recent years.
Security Debt: The Unseen Risk Undermining Cyber Resilience
White Paper

Security Debt: The Unseen Risk Undermining Cyber Resilience

This paper explores where security debt comes from, how it grows, and its consequences when left unmanaged, and shows how visibility, accountability, and shared ownership can turn debt from a liability into a tool for building trust, agility, and long-term resilience.
Building a Threat-Led Cybersecurity Program with Cyberthreat Intelligence
White Paper

Building a Threat-Led Cybersecurity Program with Cyberthreat Intelligence

Build a modern, intelligence-driven threat program that strengthens security.

Threat Modeling Revisited
White Paper

Threat Modeling Revisited

Discover how threat modeling helps businesses proactively reduce cyberrisk.

Resilience and Security in Critical Sectors: Navigating NIS2 and DORA Requirements
White Paper

Resilience and Security in Critical Sectors: Navigating NIS2 and DORA Requirements

Explore key differences between DORA and NIS2 in this EU cyber law guide.
LEVERAGING COBIT FOR EFFECTIVE AI SYSTEM GOVERNANCE
White Paper

Leveraging COBIT for Effective AI System Governance

Govern AI systems more effectively with help from the COBIT framework. Learn how COBIT supports responsible oversight as AI grows in power and complexity.
Examining Authentication in the Deepfake Era
White Paper

Examining Authentication in the Deepfake Era

This white paper explores the evolution, current state, and future trajectory of authentication technologies.

Exploring Practical Considerations and Applications for Privacy Enhancing Technologies
White Paper

Exploring Practical Considerations and Applications for Privacy Enhancing Technologies

While privacy enhancing technologies (PETs) are not new, the recent proliferation of machine learning systems, the rise of the data economy, support from policymakers, and increased privacy awareness among consumers have increased their popularity.

Using the Digital Trust Ecosystem Framework to Achieve Trustworthy AI
White Paper

Using DTEF to Achieve Trustworthy AI

This white paper explores the benefits of using ISACA’s Digital Trust Ecosystem Framework (DTEF) for enterprises adopting artificial intelligence (AI)-enabled technologies and services.
Physical Penetration Testing: The Most Overlooked Aspect of Security
White Paper

Physical Penetration Testing

This white paper provides an overview of physical penetration testing and addresses the challenges associated with its implementation.
Eliminating Deceptive Privacy Practices
White Paper

Eliminating Deceptive Privacy Practices: Building Trust by Addressing Privacy Dark Patterns

This white paper explores some common privacy dark patterns, strategies to address them and examines why dark patterns are so pervasive.
Blueprint for Ransomware Defense
White Paper

Blueprint for Ransomware Defense

The frequency, complexity, and effects of ransomware attacks continue to increase significantly worldwide. Cybercriminals have operationalized ransomware into a multibillion-dollar criminal enterprise, with the capability to exploit and disrupt even the largest and most sophisticated companies.

Load More
Incorporating Risk Management into Agile Projects
White Paper

Incorporating Risk Management into Agile Projects

As enterprises transition to Agile delivery, they will need to rethink their control functions, including risk management, to keep pace with frequent release cycles.

Demystifying Linux
White Paper

Demystifying Linux

This paper explores what Linux is, how it works, and how practitioners can use it to their advantage. For those who are new to Linux, this paper’s intent is to provide a very basic overview of what Linux is, how it came to be, and how it can be used in your day-to-day activities.
5G Privacy: Addressing Risk and Threats
White Paper

5G Privacy: Addressing Risk and Threats

This paper reviews 5G network architecture with special attention to its privacy features.
Using Risk Tolerance to Support Enterprise Strategy
White Paper

Using Risk Tolerance to Support Enterprise Strategy

Effective enterprise risk management requires all stakeholders to understand and communicate risk terminology consistently.

Audit Practitioner’s Guide to Machine Learning, Part 1
White Paper

Audit Practitioner’s Guide to Machine Learning, Part 1: Technology

In this two-part series, we provide an overview of machine learning (ML) and the current audit considerations, which focuses on compliance risk associated with ML.
Audit Practitioner’s Guide to Machine Learning, Part 2
White Paper

Audit Practitioner’s Guide to Machine Learning, Part 2: Compliance Risk

In this two-part series, we provide an overview of machine learning (ML) and the current audit considerations, which focuses on compliance risk associated with ML.
Defending Data Smartly
White Paper

Defending Data Smartly

With the growing prevalence of digital banking, our collective financial and intellectual wealth and value have begun to transition to a digital model.

IT Audit Perspectives on Today’s Top Technology Risks
White Paper

IT Audit Perspectives on Today’s Top Technology Risks

This white paper details the results of the ISACA/Protiviti global survey into the top technology risks as ranked by more than 7,500 IT auditors and professionals.
How to Drive Growth, Strategy and Governance Through Design
White Paper

How to Drive Growth, Strategy and Governance Through Design

Design helps to answer core questions—for example, how a user may experience a product or service at a physical, emotional or visceral level.

China's Personal Information Protection Law
White Paper

Insights Into China’s Personal Information Protection Law

On 20 August 2021, the National People's Congress (NPC) passed the final version of the Personal Information Protection Law (PIPL) of the People’s Republic of China, a comprehensive privacy law that covers multiple facets of personal information protection.

Digital Trust: A Modern-Day Imperative
White Paper

Digital Trust A Modern Day Imperative

With cybersecurity, risk, data privacy, governance and ethics playing critical roles in the modern business landscape, becoming a digitally trustworthy enterprise is important for organizations to enhance reputations, their relationships and brand loyalty with customers. Download this free guide to learn why digital trust is so essential, and how you can play a key role in its pursuit.
Zero Trust: How to Beat Adversaries at Their Own Game
White Paper

Zero Trust: How to Beat Adversaries at Their Own Game

This white paper describes the Zero Trust principle and outlines benefits for securing enterprises of all sizes against cybersecurity threats.

How to Be a Leader People Don't Want to Leave
White Paper

How to Be a Leader People Don't Want to Leave

Insights from our ISACA experts on how to strengthen your leadership skill set to build a stronger team.
Governance Roundup - What Are You Doing About Environmental, Social and Governance Factors in Your Enterprise?
White Paper

Governance Roundup - What Are You Doing About Environmental, Social and Governance Factors in Your Enterprise?

Learn about the importance of establishing an environmental, social and governance (ESG) framework and applying it to the daily operations of your enterprise.

Privacy in Practice 2022
White Paper

Privacy in Practice 2022

Track the latest technical trends in data privacy and obtain inside info on how enterprises are following privacy by design with the Privacy in Practice 2022 report.

MD-WHPAA
White Paper

Destination: Agile Auditing

Audit practitioners who want to get the most out of Agile auditing practices will benefit from diving into the concepts and approaches outlined in this white paper.

AI Uses in Blue Team Security
White Paper

AI Uses in Blue Team Security

Machine learning (ML) and artificial intelligence (AI) are being used to better equip cybersecurity teams for emerging threats, but each has its limitations.
Safeguarding the Future
White Paper

Safeguarding the Future

Protect your organization and help your staff provide added value above and beyond the cost of certification.

Ensuring Privacy Through Effective Data Management
White Paper

Ensuring Privacy Through Effective Data Management

Learn more about how you can leverage privacy and data management to meet organizational goals with ISACA®’s publication Ensuring Privacy Through Effective Data Management
Assessing IoT
White Paper

Assessing IoT

Internet of Things (IoT) advancements hold the potential for rapid innovation. When combined with machine learning and artificial intelligence, IoT creates a vast opportunity for innovators, with either positive or negative intentions.

A Holistic Approach to Mitigating Harm From Insider Threats
White Paper

A Holistic Approach to Mitigating Harm from Insider Threats

Insider threats can be particularly dangerous to an organization because the individuals involved have easy access to organizational resources that are not obtainable by the general public.
Optimizing Risk Response
White Paper

Optimizing Risk Response

Learn more about how risk response can help business leaders navigate the constantly evolving digital landscape with ISACA®’s publication, Optimizing Risk Response
5 Ways to Improve the Quality Mindset of Your Organization
White Paper

5 Ways to Improve the Quality Mindset of Your Organization

Explore how to begin your journey towards continuous improvement based on lessons learned from the Voluntary Improvement Program.
Using ITIL 4 and COBIT 2019 to Create an Integrated I&T Framework Environment
White Paper

Using ITIL 4 and COBIT 2019 to Create An Integrated I&T Framework Environment

Learn more about how COBIT and ITIL can work together to maximize your organization’s governance and value creation with ISACA®’s publication, Creating an Integrated I&T Framework
Cyberrisk Quantification
White Paper

Cyberrisk Quantification

One definition of risk is the likelihood of a particular event occurring factored against the real and opportunity costs associated with the event.

Blockchain Risk Considerations for Professionals
White Paper

Blockchain Risk Considerations for Professionals

Acquire a better understanding of the security risks faced by blockchain technology, recognize control gaps and reduce the likelihood of attacks by learning how to identify and understand.
Case for Quality -Voluntary Manufacturing and Product Quality Pilot Program
White Paper

Case for Quality: Voluntary Manufacturing and Product Quality Pilot Program Results

FDA launched the Case for Quality (CfQ) in 2011 to elevate the focus of all medical device stakeholders from baseline regulatory compliance to sustained, predictive practices that advance medical device quality and safety to achieve better patient outcomes.

Cybersecurity Maturity: Gaps and Solutions
White Paper

Cybersecurity Maturity: Gaps and Solutions

Focusing on risk-based capabilities is foundational to building resilience. Because there is no “one size fits all” approach, each security program must be suited to the appropriate business type and tailored to the unique risks they face.

MD-WHP5GS
White Paper

5G Security: Addressing Risk and Threats of Mobile Network Technologies

This white paper clearly presents complex info with practical insights—ideal for security professionals managing IoT and emerging tech risks.
Reporting Cybersecurity Risk to the Board of Directors
White Paper

Reporting Cybersecurity Risk to the Board of Directors

Cybersecurity professionals understand the importance of their function from a technological perspective certainly and most likely from a basic strategic and economic point-of-view as well.
Blockchain - An Executive View
White Paper

Blockchain - An Executive View

Blockchain and distributed ledger technologies are poised to take on applications across the breadth of the global digital economy.
An ITAF Approach to IT Audit Advisory Services
White Paper

An ITAF Approach to IT Audit Advisory Services

With the fast pace of digital transformation, IT auditors may find themselves at a crossroads. Auditors are finding their roles within an enterprise shifting as they are asked to provide their expertise in an advisory or consultative capacity.

Managing Security Impacts in a Multicloud Environment
White Paper

Managing Security Impacts in a Multicloud Environment

Many enterprises are now using multiple cloud services, which can in turn present information security challenges. Learn how to create a sound security strategy in our new white paper, Managing Security Impacts in a Multicloud Environment.
Implementing Robotic Process Automation (RPA)
White Paper

Implementing Robotic Process Automation (RPA)

This report covers RPA planning steps, benefits, and key security, governance, and risk factors for organizations starting their RPA journey.
Privacy: Beyond Compliance
White Paper

Privacy: Beyond Compliance

Privacy has been pushed into focus ever since the launch of the Internet, changing the way boards oversee compliance with privacy regulations.

Supply Chain Resilience and Continuity
White Paper

Supply Chain Resilience and Continuity

With each major disaster we confront—including the current pandemic—business continuity management must continue to evolve. Learn how in our new white paper: Supply Chain Resilience and Continuity: Closing Gaps Exposed in a Global Pandemic.
Achieving Data Security and Compliance
White Paper

Achieving Data Security and Compliance

Discover how to unify data security and compliance needs while protecting IP and reputation in this white paper on evolving enterprise security strategies.
WHPAOO
White Paper

Audit Oversight for Onboarding Vendors

It’s a reality of modern business that organizations need to outsource certain business activities to vendors. Without vendors, organizations would be left to fill gaps created by the need for specialized knowledge, the desire to increase revenue, or lower costs.

Conducting an IT Security Risk Assessment
White Paper

Conducting an IT Security Risk Assessment

This white paper guides new IT security and risk professionals through the process of conducting an IT security risk assessment.
Rethinking Data Governance and Management
White Paper

Rethinking Data Governance and Management

Rethinking your approach to data management can maximize your competitive advantage.

Bridging the Digital Risk Gap
White Paper

Bridging the Digital Risk Gap

This white paper discusses how complementary these functions can be to each other, and to the overall development of enterprise strategy and goals.

Managing Third-Party Risk
White Paper

Managing Third-Party Risk

Today, almost every enterprise relies on third-party vendors to help facilitate the creation and delivery of products and services.

Continuous Oversight in the Cloud
White Paper

Continuous Oversight in the Cloud

Learn about a set of distinct, but related, management and assurance practices that address critical emerging risk domains, including security, privacy and compliance.
Improving Security Awareness Using Marketing Techniques
White Paper

Improving Security Awareness Using Marketing Techniques

Enterprises spend large amount of time and money on information security training and awareness for employees to drive various positive outcomes: better threat responses, reduced risky behavior, and increased regulatory compliance.
Phishing Defense and Governance
White Paper

Phishing Defense and Governance

Phishing and email-borne attacks more than doubled from 2017 to 2018, and global financial losses from these attacks exceeded $12 billion over an 18-month period, according to law enforcement statistics.
Enforcing Data Privacy in the New Digital World
White Paper

Enforcing Data Privacy in the New Digital World

The modern enterprise is awash in data—from customers, vendors and employees, from transactions, research and investigations. And the amount of data is increasing rapidly as emerging technologies take hold—such as robotics, Internet of Things (IoT) and artificial intelligence (AI).

Governance Playbook: Integrating Frameworks to Tackle Cybersecurity
White Paper

Governance Playbook: Integrating Frameworks to Tackle Cybersecurity

No enterprise—regardless of its industry, type, size, or geographic location—is exempt from cyberthreats. As the need to move information in today’s economy is vital to success, we have to recognize that cybersecurity is no longer simply an IT issue and consider it in the larger picture of enterprise governance.
Auditing Artificial Intelligence
White Paper

Auditing Artificial Intelligence

This white paper focuses on what auditors need to know as they prepare to focus on AI.
How to Audit GDPR
White Paper

How to Audit GDPR

This collection of audit guidance from ISACA can you and your enterprise better protect data within your organization and reaffirm compliance to stakeholders.
Auditing and Knowledge Management
White Paper

Auditing and Knowledge Management

Audit program results are only as reliable as the inputs and information that go into them.

Continuous Assurance Using Data Threat Modeling
White Paper

Continuous Assurance Using Data Threat Modeling

Business professionals and IT practitioners agree that data are a valuable commodity for enterprises in many ways. The notion of using data to help monitor and manage risk tolerances in audit and assurance activities is often overlooked.

ISACA Tech Brief: The Darknet
White Paper

ISACA Tech Brief: The Darknet

The Darknet is a portion of the Internet that more and more people have heard about, but very few have visited. There’s a reason for that—the darknet, the people who use it anonymously, and the activities that take place there don’t want to be uncovered, except by others who also wish to engage in those hidden activities.
A Risk-Aware Path to Cybersecurity Resilience and Maturity
White Paper

A Risk-Aware Path to Cybersecurity Resilience and Maturity

This white paper explores key enterprise cybersecurity challenges that raise risk due to unrecognized and unresolved capability gaps.
Cloud Access Security Brokers
White Paper

ISACA Tech Brief: Cloud Access Security Brokers

While cloud computing has actually been in use by enterprises for decades, the popularity of these services has skyrocketed in recent years.

Maintaining Data Protection and Privacy Beyond GDPR Implementation
White Paper

Maintaining Data Protection and Privacy Beyond GDPR Implementation

The EU’s General Data Protection Regulation (GDPR) becomes applicable and enforceable on 25 May 2018. Any enterprise that collects data on individuals in the EU must institute specific privacy protections for that information or face regulatory penalties for violations.
Cybercrime: Defending Your Enterprise
White Paper

Cybercrime: Defending Your Enterprise

Advances in the digital marketplace are creating more opportunities for value—and risk. As organizations leverage cloud computing, the Internet of Things, mobile computing and social media, digital risk management takes on greater importance.
DevOps: Process Maturity By Example
White Paper

DevOps: Process Maturity By Example

DevOps represents a major paradigm shift in how enterprises author software.
Vulnerability Assessment
White Paper

Vulnerability Assessment

Enterprises are always on the lookout for security vulnerabilities—weaknesses that could be exploited by threat sources. A key tool for understanding the true nature of a potential weakness is a vulnerability assessment.

Getting Started with Data Governance Using COBIT 5
White Paper

Getting Started with Data Governance Using COBIT 5

Getting Started with Data Governance Using COBIT® 5 extends the application of the COBIT 5 framework to the practice of data governance.
Getting Started With Risk Management
White Paper

Getting Started With Risk Management

Most enterprises have some form of risk management. However, it may be driven primarily by compliance needs and emerging threats, making it a reactive function instead of a proactive one.

GDPR Data Protection Impact Assessments
White Paper

GDPR Data Protection Impact Assessments

By now you are surely aware of the European Union General Data Protection Regulation (GDPR) that goes into effect on 25 May 2018.
Adopting GDPR Using COBIT 5
White Paper

Adopting GDPR Using COBIT 5

For any enterprise in the world that conducts business with at least one citizen of the EU, that enterprise must comply with GDPR protections of personally identifiable information...
Assessing Cryptographic Systems
White Paper

Assessing Cryptographic Systems

The role of an auditor is rarely easy, but few areas of technology review and assessment are as challenging or more important as auditing cryptographic systems and components.
GEIT for Health Care
White Paper

GEIT for Health Care

Heath care is one of the most complex and regulated business sectors in the world. In addition, the rapid pace of change in the sector makes it one of the most dependent on information technology.

Blockchain Basics
White Paper

ISACA Tech Brief: Blockchain Basics

Advances in blockchain technology offer incredible opportunities for innovation by streamlining digital transactions.
Internal Control Using COBIT 5
White Paper

Internal Control Using COBIT 5

Internal controls are often not well understood in business. Contrary to some misinformed opinions, internal controls are not onerous rules that exist to make work cumbersome or more difficult.

Industrial Control Systems: A Primer for the Rest of Us
White Paper

Industrial Control Systems: A Primer for the Rest of Us

The current landscape for industrial control systems’ (ICS) cybersecurity is best described as turbulent, as system owners struggle to protect systems that were never intended to be interconnected.
Overview of Digital Forensics
White Paper

Overview of Digital Forensics

Cyber incidents are fast moving and increasing in number and severity. When a cyber incident occurs, the attacked enterprise responds with a set of predetermined actions.

Cybersecurity: What the Board of Directors Needs to Ask
White Paper

Cybersecurity: What the Board of Directors Needs to Ask

This joint project from ISACA and The Institute of Internal Auditors Research Foundation offers guidance to board members on the questions they should be asking regarding cybersecurity in their organizations.
European Cybersecurity Implementation: Assurance
White Paper

European Cybersecurity Implementation: Assurance

Cybersecurity is emerging to address increases in cybercrime and, in some instances, cyberwarfare. Factors contributing to the need for improved cybersecurity include: ubiquitous broadband, IT-centric business and society, and social stratification of IT skills.

European Cybersecurity Implementation: Overview
White Paper

European Cybersecurity Implementation: Overview

Cybersecurity is emerging to address increases in cybercrime and, in some instances, cyberwarfare.

European Cybersecurity Implementation: Resilience
White Paper

European Cybersecurity Implementation: Resilience

As part of the ISACA European Cybersecurity Implementation Series, this paper focuses on resilience in cybersecurity.

European Cybersecurity Implementation: Risk Guidance
White Paper

European Cybersecurity Implementation: Risk Guidance

As part of the ISACA European Cybersecurity Implementation Series, this paper focuses on risk guidance in a cybersecurity context, and drills down into the risk management aspects of European cybersecurity.
Relating the COSO Internal Control—Integrated Framework & COBIT
White Paper

Relating the COSO Internal Control—Integrated Framework & COBIT

This white paper uses the updated COSO framework to examine how COBIT 5 components and guidance align with and relate to COSO’s structure and content.
Information Systems Auditing Tools and Techniques
White Paper

Information Systems Auditing Tools & Techniques: Creating Audit Programs

Audits are important tools for organizations. A thoroughly conducted audit program can assure organizational stakeholders of the financial, operational and ethical well-being of an organization.

Guiding Principles for Cloud Computing Adoption and Use
White Paper

Guiding Principles for Cloud Computing Adoption and Use

The drive for value, the need to reduce technology costs and the business demand for increased agility in how technology is used have caused enterprises to adopt cloud computing strategies.

Mobile Payments: Risk, Security and Assurance Issues
White Paper

Mobile Payments: Risk, Security and Assurance Issues

Mobile payments as a financial transaction medium emerged around a decade ago. Adoption was slow due to the nature of the mobile technology supporting the concept.

Security Information and Event Management: Business Benefits
White Paper

Security Information and Event Management: Business Benefits

In today’s information-driven business environment, enterprise systems and processes capture an ever-increasing amount of data.

Cloud Computing: Business Benefits and Security, Governance & Assurance Perspective
White Paper

Cloud Computing: Business Benefits and Security, Governance & Assurance Perspectives

Cloud computing helps enterprises lower TCO, boost ROI, improve efficiency, enable dynamic provisioning, and offer utility-style pay-as-you-go services.
Brazilian Portuguese: Cyberrisk Quantification
White Paper

Cyberrisk Quantification | Brazilian Portuguese

Podemos considerar como uma definição de risco a probabilidade de um determinado evento ocorrer, levando em consideração os custos reais e de oportunidade associados a esse evento.

Spanish: Cyberrisk Quantification
White Paper

Cyberrisk Quantification | Spanish

Una definición de riesgo es la probabilidad de que ocurra un evento en particular frente a los costos reales y de oportunidad asociados con el evento. Pero, ¿cómo se determinan los costos asociados con un evento como un ciberataque?

Spanish: Adopting GDPR Using COBIT 5
White Paper

Adopting GDPR Using COBIT 5 | Spanish

The clock is ticking on the May 2018 deadline for compliance with the European Union’s General Data Protection Regulation (GDPR).

Polish: Cybersecurity: What the Board of Directors Needs to Ask
White Paper

Cybersecurity: What the Board of Directors Needs to Ask | Polish

This joint project from ISACA and The Institute of Internal Auditors Research Foundation offers guidance to board members on the questions they should be asking regarding cybersecurity in their organizations.

Custom Training Programs

Looking to train your team? We can customize virtual training and certification programs for every need.

GET STARTED