Which of the following should exist in order to perform a security audit?

An industry framework (such as ISO 27001, NIST, or CIS Controls) is a prerequisite for a security audit because it defines the specific controls, benchmarks, and criteria against which the organization's security posture is evaluated. Without a framework, there is no objective baseline to measure compliance or identify gaps. The framework provides the structured methodology and scope that makes the audit valid and reproducible.

While external auditors can add objectivity, they are not a strict requirement - many valid security audits are conducted internally, making a third-party auditor optional rather than mandatory.

An internal certified auditor is one valid option for conducting an audit, but certification and internal status are not universally required prerequisites; what matters is having a standard to audit against, not who performs the audit.

Auditor neutrality is a best practice that improves audit quality and credibility, but it is not a foundational requirement that must exist before an audit can be performed - an audit can still occur without guaranteed neutrality.