Network Audit Checklist

• Conducted on

  Date

• System Owner

• Prepared by

• Site/Location
  Address

Firewall

• The organisation should have a firewall or equivalent in place to protect their internal network and devices against unauthorised access

  Yes

  In Progress

  No

  Not Applicable

• The password on the firewall device should be changed from the default to an alternative strong password

  Yes

  In Progress

  No

  Not Applicable

• The firewall password is:

• • at least 8 characters long

  Yes

  In Progress

  No

  Not Applicable

• • not the same as the username

  Yes

  In Progress

  No

  Not Applicable

• • does not contain any identical characters next to each other

  Yes

  In Progress

  No

  Not Applicable

• • is not a dictionary word

  Yes

  In Progress

  No

  Not Applicable

• • includes upper and lower case letters, numbers and special characters

  Yes

  In Progress

  No

  Not Applicable

• • has not been reused within a predetermined time period

  Yes

  In Progress

  No

  Not Applicable

• • has not been used for another account

  Yes

  In Progress

  No

  Not Applicable

• Each rule set on the firewall must be approved by an authorised individual and documented including an explanation of the business need for this rule.

  Yes

  In Progress

  No

  Not Applicable

• Unapproved or vulnerable services should be blocked at the gateway firewall

  Yes

  In Progress

  No

  Not Applicable

• Any permissive firewall rules that are no longer required should be disabled as soon as possible

  Yes

  In Progress

  No

  Not Applicable

• The firewall’s boundary administration settings should not be accessible from the internet

  Yes

  In Progress

  No

  Not Applicable

Computers and Network Devices (including Wireless Access Points and Routers)

• IMPORTANT: All computers and devices on the network must comply with the following in order to give a ‘Yes’ response.

• All unnecessary user accounts, guest or admin accounts should be removed or disabled

  Yes

  In Progress

  No

  Not Applicable

• All user account passwords meet the following requirements:

• • has been changed from the default password

  Yes

  In Progress

  No

  Not Applicable

• • at least 8 characters long

  Yes

  In Progress

  No

  Not Applicable

• • not the same as the username

  Yes

  In Progress

  No

  Not Applicable

• • does not contain any identical characters next to each other

  Yes

  In Progress

  No

  Not Applicable

• • is not a dictionary word

  Yes

  In Progress

  No

  Not Applicable

• • includes upper and lower case letters, numbers and special characters

  Yes

  In Progress

  No

  Not Applicable

• • has not been reused within a predetermined time period

  Yes

  In Progress

  No

  Not Applicable

• • has not been used for another account

  Yes

  In Progress

  No

  Not Applicable

• All unnecessary software applications and utilities should be removed or disabled

  Yes

  In Progress

  No

  Not Applicable

• All auto-run features should be disabled including for removable storage media and for network folders

  Yes

  In Progress

  No

  Not Applicable

• An operating systems with integrated desktop firewall should be used on desktop PCs and laptops and configured to block unapproved connections by default. In the latest operating systems, active, and configured.

  Yes

  In Progress

  No

  Not Applicable

User Accounts

• All users accounts and their privileges should be subject to an approval process and should be documented

  Yes

  In Progress

  No

  Not Applicable

• Admin privileges and any other special access privileges should be restricted to authorised individuals and documented

  Yes

  In Progress

  No

  Not Applicable

• Admin accounts should only be used to perform admin tasks and not for everyday access

  Yes

  In Progress

  No

  Not Applicable

• Admin accounts should be set to require a password change every 60 days or less

  Yes

  In Progress

  No

  Not Applicable

• Every individual user should have a unique user name and user account

  Yes

  In Progress

  No

  Not Applicable

• Every user password should meet the following requirements:

• • at least 8 characters long

  Yes

  In Progress

  No

  Not Applicable

• • not the same as the username

  Yes

  In Progress

  No

  Not Applicable

• • does not contain any identical characters next to each other

  Yes

  In Progress

  No

  Not Applicable

• • is not a dictionary word

  Yes

  In Progress

  No

  Not Applicable

• • includes upper and lower case letters, numbers and special characters

  Yes

  In Progress

  No

  Not Applicable

• • has not been reused within a predetermined time period

  Yes

  In Progress

  No

  Not Applicable

• • has not been used for another account

  Yes

  In Progress

  No

  Not Applicable

• Any user account with special privileges or admin rights should be removed or disabled when no longer required or if the individual changes role or leaves the organisation or after a predefined length of inactivity (eg. if the account is not used for 90 days then it is disabled)

  Yes

  In Progress

  No

  Not Applicable

Malware Protection

• Malware protection software is to be installed on all computers that can access the internet or are capable of accessing the internet

  Yes

  In Progress

  No

  Not Applicable

• Malware protection software is to be kept up to date daily

  Yes

  In Progress

  No

  Not Applicable

• Malware protection software should be configured to scan files automatically upon access and to scan web pages when being accessed via a web browser

  Yes

  In Progress

  No

  Not Applicable

• Malware protection software should be configured to perform regular scans of all files

  Yes

  In Progress

  No

  Not Applicable

• Malware protection software should prevent connections to malicious websites on the internet (e.g. by using website blacklisting).

  Yes

  In Progress

  No

  Not Applicable

Software Patch Management

• Software on any devices that are connected to or are capable of connecting to the internet must be licensed and supported to ensure vulnerabilities are investigated and patches made available.

  Yes

  In Progress

  No

  Not Applicable

• All software updates and security patches that are made available should be installed in a timely manner

  Yes

  In Progress

  No

  Not Applicable

• Any unsupported software should be removed from any computer or device capable of connecting to the internet

  Yes

  In Progress

  No

  Not Applicable

Others

• Wireless Protected Setup (WPS) to be disabled on all wireless devices

  Yes

  In Progress

  No

  Not Applicable

• Universal Plug n Play (UPnP) to be disabled

  Yes

  In Progress

  No

  Not Applicable

• Guest WiFi access to be implemented for visitors and employee owned devices

  Yes

  In Progress

  No

  Not Applicable

• Employee owned devices that can access company email or information will require malware software

  Yes

  In Progress

  No

  Not Applicable

• All network servers must have a daily automated backup solution with backup data stored securely offsite (encrypted)

  Yes

  In Progress

  No

  Not Applicable

• Encryption of all sensitive data stored on mobile devices and removable storage devices

  Yes

  In Progress

  No

  Not Applicable

• Do not allow staff to use file sharing or cloud storage services for company data such as DropBox, OneDrive, Google Drive, iCloud – unless they are authorised by and secured for your organisation.

  Yes

  In Progress

  No

  Not Applicable

• Staff should not be permitted to use personal social media accounts on organisation-owned devices or on any devices connected to the network unless specifically authorised to do so.

  Yes

  In Progress

  No

  Not Applicable

Completion

• Recommendations

• Name and Signature

  Sign