Sources of information:
• Previous audit reports
• Process maps and system flows
• Network maps
• SLAs
• Internal policies, standards and procedures
• Books
• Software development documentation
• Training manuals
• Installation/configuration manuals
• Supplier web sites
• User forums
• Security configuration recommended by vendors
• International standards for specific technologies