Published 2025-01-22 by TechNet New England
An IT audit systematically reviews your technology environment to identify risks, inefficiencies, and areas for improvement. Whether conducted internally or by an outside party, regular audits keep your IT healthy and your business protected.
Why Conduct IT Audits
- Identify security vulnerabilities before attackers do
- Ensure compliance with industry regulations
- Verify that IT investments are providing value
- Find inefficiencies and opportunities for improvement
- Validate that policies and procedures are being followed
IT Audit Checklist
Infrastructure and Hardware
- Complete inventory of all hardware assets
- Age and warranty status of critical equipment
- Physical security of servers and network equipment
- Environmental controls (power, cooling, fire suppression)
- End-of-life planning for aging equipment
- UPS and backup power systems tested
Network Security
- Firewall rules reviewed and documented
- Intrusion detection/prevention systems active
- Network segmentation properly configured
- Wireless security settings verified
- Remote access methods secure
- Network diagram current and accurate
Access Controls
- User accounts inventoried and reviewed
- Terminated employee accounts disabled
- Privileged accounts limited and monitored
- Password policies enforced
- Multi-factor authentication enabled
- Access rights follow least privilege principle
Data Protection
- Backup systems functioning correctly
- Backup restores tested
- Offsite or cloud backups current
- Sensitive data identified and protected
- Encryption used appropriately
- Data retention policies followed
Endpoint Security
- All devices have current endpoint protection
- Operating systems fully patched
- Applications updated
- Mobile devices managed
- Encryption enabled on laptops
Software and Licensing
- Software inventory complete
- License compliance verified
- Unauthorized software identified
- End-of-support software planned for upgrade
- SaaS subscriptions reviewed
Policies and Procedures
- IT policies documented and current
- Acceptable use policy in place
- Incident response plan documented
- Disaster recovery plan current and tested
- Security awareness training conducted
- Policy acknowledgments on file
Compliance
- Applicable regulations identified
- Required controls implemented
- Documentation maintained
- Vendor compliance verified (BAAs, etc.)
- Risk assessments current
Vendor Management
- Vendor contracts reviewed
- Service level agreements in place
- Vendor security requirements verified
- Contact information current
- Renewal dates tracked
After the Audit
- Document all findings
- Prioritize issues by risk
- Create a remediation plan with timelines
- Assign responsibility for each action item
- Schedule follow-up to verify completion
- Plan the next audit
Regular IT audits should be part of your standard business operations, not just something you do before a compliance review. Contact TechNet New England for a professional IT audit of your environment.