Our summary
The Cybersecurity Topical Requirement was the first Topical Requirement issued by The IIA. It was issued on 5 February 2025 and became effective on 5 February 2026. It sets a minimum baseline for assessing how an organization designs and runs its cybersecurity governance, risk management and control processes. It is a mandatory part of the IPPF, used together with the Global Internal Audit Standards.
The requirement does not force internal audit to put cybersecurity in the audit plan. But when cybersecurity is in scope of an assurance engagement, auditors must assess each requirement and document why any part does not apply. The page offers the requirement free in more than 30 languages, including Arabic and French, plus a User Guide with practical considerations and a mapping to NIST and COBIT. It also links to the general Topical Requirements Application Guidance.
How auditors use it: Use it as the minimum checklist for any audit that touches cybersecurity. Map it to the framework the organization already uses (for example NIST CSF), keep evidence that each requirement was assessed, and record the reasons for any exclusions so you can show conformance in a quality assessment.