An Analysis of Influential Factors for the Information Security Audit Labor Times and Regressive Estimation of the Labor times

摘要

Based on the factors that are available at the initial phase of the audit task, a labor time estimation method for the information security audit is proposed, statistically analyzing the data of the past 20 cases. Initially, audit mode, operation mode, penetration degree, company size, number of business sites, and type of industry are considered to be the factors that could influence the labor time, and thus the "quantitative analysis I" is conducted with these factors. However, it was revealed that the number of business sites and the type of business do not exert decisive influence on labor times. Therefore, our analysis was done, employing these four as factors: audit form, operation form, penetration degree, and business site size. However, the results were not sufficiently positive. As a result, by dividing audit mode into regular and emergency audit and by using company size as the factor, labor time estimation formula has been established by means of the regression analysis. Compared to the traditional estimation by skilled systems engineers with around 15% error, this proposed formula has 6 to 11% error, which means that this formula has enough practical accuracy.