Security Audit Checklist

• Audit Title

• Client/Company Name

• Location
  Address

• Conducted on

  Date

• Conducted by

• Progress through the following sections, answering each question. When an item is non-compliant or marked as fail, be sure to add notes and/or media as evidence.

Access Controls

• Are user accounts created with strong passwords?

  Yes

  No

  N/A

• Is multi-factor authentication (MFA) implemented for privileged accounts?

  Yes

  No

  N/A

• Are access rights regularly reviewed and revoked for terminated employees?

  Yes

  No

  N/A

• Does the facility use an automated access control system?

  Yes

  No

  N/A

• Are card readers utilized at all access points?

  Yes

  No

  N/A

• Are card readers securely fastened and in good working order?

  Yes

  No

  N/A

Network Security

• Is a firewall in place to control incoming and outgoing network traffic?

  Yes

  No

  N/A

• Are intrusion detection and prevention systems (IDPS) deployed?

  Yes

  No

  N/A

• Are network devices regularly patched and updated?

  Yes

  No

  N/A

Data Protection

• Is sensitive data encrypted both at rest and in transit?

  Yes

  No

  N/A

• Are regular data backups performed and tested for recoverability?

  Yes

  No

  N/A

• Are data access and usage monitored and logged?

  Yes

  No

  N/A

Physical Security

• Are all the doors and windows secure and able to be locked?

  Yes

  No

  N/A

• Are physical access controls implemented, such as access badges or biometric systems?

  Yes

  No

  N/A

• Are server rooms and data centers secured with appropriate physical safeguards?

  Yes

  No

  N/A

• Is after-hours access to server rooms monitored/controlled?

  Yes

  No

  N/A

• Are the external walls fit for purpose and are they secure?

  Yes

  No

  N/A

• Is there a visitor log and escort policy for visitors entering restricted areas?

  Yes

  No

  N/A

• Are perimeter doors alarmed?

  Yes

  No

  N/A

• Are alarms active during the day or are areas shut off?

  Yes

  No

  N/A

• Is there a regular lock-up routine?

  Yes

  No

  N/A

• Are perimeter doors supported by cameras?

  Yes

  No

  N/A

• Are computers marked with serial numbers or company information?

  Yes

  No

  N/A

• Is an intrusion alarm system used in the facility?

  Yes

  No

  N/A

• Is the intrusion alarm system in good working order?

  Yes

  No

  N/A

• Does the alarm system have a power backup?

  Yes

  No

  N/A

• Are fire prevention and suppression systems in place?

  Yes

  No

  N/A

• Are power backups available?

  Yes

  No

  N/A

• Is environmental monitoring implemented?

  Yes

  No

  N/A

Incident Response

• Is an incident response plan in place and regularly tested?

  Yes

  No

  N/A

• Are security incidents and breaches promptly reported and investigated?

  Yes

  No

  N/A

• Is there a process for notifying affected parties in the event of a data breach?

  Yes

  No

  N/A

Employee Awareness and Training

• Are employees provided with security awareness training?

  Yes

  No

  N/A

• Do they understand the importance of vigilance and challenging suspicious activity?

  Yes

  No

  N/A

• Do employees sign an acceptable use policy regarding information security?

  Yes

  No

  N/A

• Are employees regularly reminded of security best practices and policies?

  Yes

  No

  N/A

• Are employees aware of and compliant on how to report suspicious activities or incidents?

  Yes

  No

  N/A

Compliance

• Is the organization compliant with relevant security regulations and standards?

  Yes

  No

  N/A

• Are security audits conducted by third-party assessors periodically?

  Yes

  No

  N/A

• Is there a process for addressing security audit findings and implementing corrective actions?

  Yes

  No

  N/A

• Are all security policies and procedures documented?

  Yes

  No

  N/A

• Are vendor and third-party risk management plans in place?

  Yes

  No

  N/A

Electronic Security

• Is there ample/well-maintained lighting?

  Yes

  No

  N/A

• Are cameras installed?

  Yes

  No

  N/A

• How many cameras are functional?

• How many cameras are inoperable?

• Are cameras managed by security, IT, facilities, or others?

• Are monitors clear?

• Have cameras/CCTVs installed for maximum security. Assign this as an action if needed.

• Attach photos and other relevant files as evidence.

  Media

Information Security

• Is there an effective information security strategy?

  Yes

  No

  N/A

• Is there an effective IT strategy?

  Yes

  No

  N/A

Visitors Vehicle Access

• Is there an access control system in place for visitor vehicles?

  Yes

  No

  N/A

• Do visitors have to show ID?

  Yes

  No

  N/A

• Are visitors announced?

  Yes

  No

  N/A

• Are visitors required to park in certain areas?

  Yes

  No

  N/A

• Are there passes issued? If yes, describe the types of passes issued.

  Yes

  No

  N/A

General Facility Impressions and Security Posture

• What is the estimated volume of daily visitors?

• Have there been security problems in the past? Describe in detail.

• What are the biggest threats to security?

• What assets at the facility need to be protected?

• Summary of Findings

• Remediation and Action Plans

• Date of Next Audit

• Auditor's Name and Signature

  Sign