Security Audit Checklist

• Audit Title

• Client/Company Name

• Location
  Address

• Conducted on

  Date

• Conducted by

• Progress through the following sections, answering each question. When an item is non-compliant or marked as fail, be sure to add notes and/or media as evidence.

Access Controls

• Are user accounts created with strong passwords?

  Yes

  No

  N/A

• Is multi-factor authentication (MFA) implemented for privileged accounts?

  Yes

  No

  N/A

• Are access rights regularly reviewed and revoked for terminated employees?

  Yes

  No

  N/A

• Does the facility use an automated access control system?

  Yes

  No

  N/A

• Are card readers utilized at all access points?

  Yes

  No

  N/A

• Are card readers securely fastened and in good working order?

  Yes

  No

  N/A

Network Security

• Is a firewall in place to control incoming and outgoing network traffic?

  Yes

  No

  N/A

• Are intrusion detection and prevention systems (IDPS) deployed?

  Yes

  No

  N/A

• Are network devices regularly patched and updated?

  Yes

  No

  N/A

Data Protection

• Is sensitive data encrypted both at rest and in transit?

  Yes

  No

  N/A

• Are regular data backups performed and tested for recoverability?

  Yes

  No

  N/A

• Are data access and usage monitored and logged?

  Yes

  No

  N/A

Physical Security

• Are all the doors and windows secure and able to be locked?

  Yes

  No

  N/A

• Are physical access controls implemented, such as access badges or biometric systems?

  Yes

  No

  N/A

• Are server rooms and data centers secured with appropriate physical safeguards?

  Yes

  No

  N/A

• Is there a visitor log and escort policy for visitors entering restricted areas?

  Yes

  No

  N/A

• Are perimeter doors alarmed?

  Yes

  No

  N/A

• Are perimeter doors supported by cameras?

  Yes

  No

  N/A

• Are computers marked with serial numbers or company information?

  Yes

  No

  N/A

• Is an intrusion alarm system used in the facility?

  Yes

  No

  N/A

• Are fire prevention and suppression systems in place?

  Yes

  No

  N/A

• Are power backups available?

  Yes

  No

  N/A

Incident Response

• Is an incident response plan in place and regularly tested?

  Yes

  No

  N/A

• Are security incidents and breaches promptly reported and investigated?

  Yes

  No

  N/A

• Is there a process for notifying affected parties in the event of a data breach?

  Yes

  No

  N/A

Employee Awareness and Training

• Are employees provided with security awareness training?

  Yes

  No

  N/A

• Do they understand the importance of vigilance and challenging suspicious activity?

  Yes

  No

  N/A

• Do employees sign an acceptable use policy regarding information security?

  Yes

  No

  N/A

• Are employees regularly reminded of security best practices and policies?

  Yes

  No

  N/A

• Are employees aware of and compliant on how to report suspicious activities or incidents?

  Yes

  No

  N/A

Compliance

• Is the organization compliant with relevant security regulations and standards?

  Yes

  No

  N/A

• Are security audits conducted by third-party assessors periodically?

  Yes

  No

  N/A

• Is there a process for addressing security audit findings and implementing corrective actions?

  Yes

  No

  N/A

• Are all security policies and procedures documented?

  Yes

  No

  N/A

• Are vendor and third-party risk management plans in place?

  Yes

  No

  N/A

Information Security

• Is there an effective information security strategy?

  Yes

  No

  N/A

• Is there an effective IT strategy?

  Yes

  No

  N/A

General Facility Impressions and Security Posture

• What is the estimated volume of daily visitors?

• Have there been security problems in the past? Describe in detail.

• What are the biggest threats to security?

• What assets at the facility need to be protected?

• Summary of Findings

• Remediation and Action Plans

• Date of Next Audit

• Auditor's Name and Signature

  Sign