Security Audit Checklist

Going Deeper: Network-Specific Checks Auditors Often Miss

A general checklist sets the structure, but most real findings turn up in the details of how a network is built and maintained. Once the asset list and risk assessment are done, these technical checks help turn a paper exercise into an audit that reflects what is actually running on the wire.

Compare the map to reality

Start with your documented topology and test it against what discovery tools report. Unmanaged switches, forgotten test VLANs, consumer-grade access points plugged in under a desk, and old VPN endpoints that were never decommissioned are common surprises. If your diagrams are out of date, updating them is an audit finding in its own right. Our network overview shows the kind of topology clarity worth aiming for.

Review configuration and access

• Default credentials: confirm that routers, firewalls, printers and IoT devices no longer use factory passwords.
• Management interfaces: check that admin panels and SSH are reachable only from a dedicated management network, not from guest or user segments.
• Firewall rules: look for broad "any-any" rules, rules with no owner or comment, and temporary exceptions that became permanent.
• Accounts: remove access for departed staff and contractors, and confirm multi-factor authentication on remote access and cloud consoles.

Patch levels and firmware

Operating systems usually get patched; network gear often does not. Record firmware versions on switches, firewalls and wireless controllers and compare them against vendor advisories. Devices that have reached end of support deserve a replacement plan, because no amount of configuration fixes an unpatched vulnerability.

Logging and visibility

An incident response plan depends on evidence. Verify that critical devices send logs to a central location, that clocks are synchronised so timestamps line up, and that logs are retained long enough to investigate an incident discovered weeks later. Test it: pick a recent event and see whether you can reconstruct who connected, from where, and when.

Backups and recovery

Confirm that device configurations and key data are backed up, that at least one copy is offline or immutable, and that a restore has actually been tested. A backup that has never been restored is an assumption, not a control.

Finally, schedule the next audit before closing this one. Annual reviews are a reasonable baseline, with lighter checks after major changes such as new sites, new partners, or a migration to cloud services. For background reading on related topics, browse the research section.