Cyber Security Audit Checklist

• Site

• Date and Time of Inspection

  Date

• Prepared by

• Location
  Address

Management

• Company security policies in place

  ✔

  ✖

  N/A

• Security policies written and enforced through training

  ✔

  ✖

  N/A

• Computer software and hardware asset list

  ✔

  ✖

  N/A

• Data classified by usage and sensitivity

  ✔

  ✖

  N/A

• Established chain of data ownership

  ✔

  ✖

  N/A

Employees

• Training on phishing, handling suspicious emails, social engineering hackers

  ✔

  ✖

  N/A

• Password training and enforcement

  ✔

  ✖

  N/A

• Training on dealing with strangers in the workplace

  ✔

  ✖

  N/A

• Training on carrying data on laptops and other devices and ensuring the security of this data

  ✔

  ✖

  N/A

• All security awareness training passed and signed off ensuring that all employees not only understand the importance of security but are active guardians for security

  ✔

  ✖

  N/A

• Bring Your Own Device (BYOD) plans are in place

  ✔

  ✖

  N/A

Business practices

• Emergency and cybersecurity response plans

  ✔

  ✖

  N/A

• Record of all possible sources of business disruption cybersecurity risk

  ✔

  ✖

  N/A

• Plans in place to lessen business disruptions and security breaches

  ✔

  ✖

  N/A

• Emergency disaster recovery plans in place

  ✔

  ✖

  N/A

• Alternative locations for running business in case of emergencies or disruptions

  ✔

  ✖

  N/A

• Redundancy and restoration paths for all critical business operations

  ✔

  ✖

  N/A

• Test restoration and redundancy plans

  ✔

  ✖

  N/A

IT staff

• System hardening plans

  ✔

  ✖

  N/A

• Automated system hardening on all operating systems on servers, routers, workstations, and gateways

  ✔

  ✖

  N/A

• Software patch management automated

  ✔

  ✖

  N/A

• Check security mailing lists

  ✔

  ✖

  N/A

• Regular security audits and penetration testing

  ✔

  ✖

  N/A

• Anti-virus software installed on all devices with auto-updates

  ✔

  ✖

  N/A

• Systematic review of log files and backup logs to make sure there are no errors

  ✔

  ✖

  N/A

• Remote plans in place, as well as policies regarding remote access

  ✔

  ✖

  N/A

Physical security

• Lock servers and network equipment

  ✔

  ✖

  N/A

• Secured and remote backup solution

  ✔

  ✖

  N/A

• Keys for the network are in a secure location

  ✔

  ✖

  N/A

• All computers are visible

  ✔

  ✖

  N/A

• Use locks on computer cases

  ✔

  ✖

  N/A

• Perform regular inspections

  ✔

  ✖

  N/A

• Prevent unauthorized users from entering the server room or even in the workstation areas

  ✔

  ✖

  N/A

• Security camera monitoring system

  ✔

  ✖

  N/A

• Keycard system required for secure areas

  ✔

  ✖

  N/A

• Secure Data Policy in place and ensure users understand the policy through training

  ✔

  ✖

  N/A

• Secure trash dumpsters and paper shredders to prevent dumpster diving

  ✔

  ✖

  N/A

Secure data

• Encryption enabled wherever required

  ✔

  ✖

  N/A

• Secure laptops, mobile devices, and storage devices

  ✔

  ✖

  N/A

• Enable automatic wiping of lost or stolen devices

  ✔

  ✖

  N/A

• Secure Sockets Layer (SSL) in place when using the Internet to ensure secure data transfers

  ✔

  ✖

  N/A

• Secure email gateways ensuring data is emailed securely

  ✔

  ✖

  N/A

Active monitoring and testing

• Regular monitoring of all aspects of security

  ✔

  ✖

  N/A

• Regularly scheduled security testing

  ✔

  ✖

  N/A

• External penetration testing to ensure your staff hasn’t missed something

  ✔

  ✖

  N/A

• Scanning for data types to make sure they are secure and properly stored

  ✔

  ✖

  N/A

Completion

• Observation

• Full name and signature of IT Supervisor

  Sign