TRC IT Site Audit

• Conducted on

  Date

• Prepared by

• Location
  Address

Ownership of Assets

• Are computers named correctly for assigned owners? – Sample 5 – 10 %

  Yes

  No

  N/A

• Are Computers/Servers correctly assigned ownership in Service Now? - Sample 5 – 10 %

  Yes

  No

  N/A

Access Control

• Is there any evidence of passwords written down?

  Yes

  No

  N/A

• Do local PC’s get the privacy pop-up after Bit-Locker? (Can ask user – don’t have to reboot)

  Yes

  No

  N/A

• Do end-user Systems have Anti-Virus, Forcepoint, ForeScout & System Center Installed?

  Yes

  N/A

• Is Web Filtering working – test websites?

  Yes

  No

  N/A

• Are patches properly installed or failing check software center?

  Yes

  No

  N/A

• Are there visitor safety tri-fold brochures at the front desk?

  Yes

  No

  N/A

• Is there unused equipment on-site ?

  Yes

  N/A

• Where is it stored?

• Is it secured?

• Who has access?

• Are there any Rogue Wireless Networks?

  Yes

  No

  N/A

Physical & Environmental Security

Physical Security Perimeter

• Is the facility secured by an Electronic Badge/FOB system?

  Yes

  N/A

• What System? (ADT or Other)

• IT managed by TRC or a 3rd Party?

• Are all external doors covered by the system?

  Yes

  No

  N/A

• Is the server room covered by the system?

  Yes

  No

  N/A

• What 3rd parties have been assigned badge access the facility?

• Who manages the Badges locally?

• Are Unused badges secured?

  Yes

  No

  N/A

• Is the office monitored by video/camera?

  Yes

  N/A

• Are all entrances / exits covered by the cameras?

  Yes

  No

  N/A

• Are the primary doors secured 24/7?

  Yes

  No

  N/A

• If primary doors are unsecured during business hours, is there always a receptionist present?

  Yes

  No

  N/A

• Are all non-primary doors secured during the day?

  Yes

  No

  N/A

• Is there a Visitor Sign-in Log at the front Desk?

  Yes

  No

  N/A

• Are office visitors issued visitor badges or tags upon sign in?

  Yes

  N/A

• Do they provide facility Access?

  Yes

  No

  N/A

Delivery and Loading Areas

• Is there a delivery/loading area in the facility?

  Yes

  N/A

• Does it connect into TRC Space?

  Yes

  N/A

• Is the access to TRC Space from the loading dock secured when not in use?

  Yes

  No

  N/A

• Is the delivery/loading area proximate to the local Server Room, Server or Networking equipment?

  Yes

  No

  N/A

Equipment Siting and Protection

• 1. Is local unused IT equipment secured?

  Yes

  No

  N/A

• Who has access?

Supporting Utilities

• Does the facility have backup power (generator)?

  Yes

  N/A

• Is the generator managed by TRC?

  Yes

  No

  N/A

• Who manages it?

• What type of power does it use (Diesel, Propane, Natural Gas, Other)

• Who is responsible for managing it?

• How often is it tested?

• What type of power does it use (Diesel, Propane, Natural Gas, Other)

• When was the last time it was tested?

  Date

• Is there a UPS for the Server & Networking Equipment?

  Yes

  N/A

• Is all the Servers & Networking equipment attached to the UPS?

  Yes

  No

  N/A

• Questions for IT Ops

  Yes

  N/A

• How often is the UPS tested?

• When was the last test?

  Date

• Is an automatic notification configured for battery replacement and for when the UPS?

  Yes

  No

  N/A

• What is the expected run time for the UPS?

• When was the battery last replaced?

  Date

Unattended User Equipment

• 1. Are there unattended systems in the office?

  Yes

  No

  N/A

• 2. Are Any Unlocked?

  Yes

  N/A

• How Many?

Clean Desk Policy

• Are there unclaimed documents on the printers/copiers?

  Yes

  No

  N/A

• Are Laptops left in the office overnight?

  Yes

  No

  N/A

• Are there shred bins in the office?

  Yes

  N/A

• Are they locked?

  Yes

  No

  N/A

• Can documentation be manually removed from the them?

  Yes

  No

  N/A

• Is there a server room at this location?

  Yes

  N/A

Secure log-on procedure – Local Office

• Do the local servers have Anti-Virus, Endpoint Protection & firewalls

  Yes

  No

  N/A

Securing offices, rooms and facilities – Server Rooms

• Is the Server Room in TRC Space or Shared Space in the facility?

  TRC Space

  Shared Space

• Is the Server Room secured 24/7?

  Yes

  No

  N/A

• Is there an access list to the building management as to who may request access?

  Yes

  No

  N/A

• If there is camera/video surveillance in the office, is the server room door being Monitored?

  Yes

  No

  N/A

• If there is a badge/fob system in the office is the server room door secured by it?

  Yes

  No

  N/A

• Which TRC Employees have access?

• Do any 3rd parties have access?

  Yes

  No

  N/A

• If Yes, who?

  Yes

  No

  N/A

• How is the server room door secured?

  Key

  Code Lock

  Other

• Is there a documented list of who has access?

  Yes

  No

  N/A

• Are keys stored appropriately?

  Yes

  No

  N/A

• Is there a lost stolen key policy?

  Yes

  No

  N/A

• 1. Is there a documented list of who has access?

  Yes

  No

  N/A

• 2. Is there a documented list of employee codes?

  Yes

  No

  N/A

• a. If yes, who has access and how is it secured?

• b. Have terminated employee codes been removed?

  Yes

  No

  N/A

• Other?

• Does the lock-set on the Server Room Auto-Unlock?

  Yes

  No

  N/A

• Is there a Server Room Sign-In sheet in the Server Room?

  Yes

  No

  N/A

• Is it by the Server Room door? (Take Picture) (Video)

  Yes

  No

  N/A

• If Yes, Inside or Outside

• When was the last documented time the server room was accessed?

  Yes

  No

  N/A

• Is the Appropriate Signage on the server room Door?

  Yes

  No

  N/A

• Is the Server/Network Equipment in a lockable Rack/Cabinet?

  Yes

  No

  N/A

• What type of Lock – Key, Code, Other?

  Key

  Code Lock

  Other

• Is the Rack locked?

  Yes

  No

  N/A

• Who has access to keys?

• Where are keys stored?

• Does the cleaning staff have access to the server room?

  Yes

  No

  N/A

• Is there dedicated AC in the server room?

  Yes

  No

  N/A

• What are the hours of operation?

• What is the temperature setting?

• Is there a Spot Cooler in the Server room?

  Yes

  No

  N/A

• Does water need to be manually dumped?

  Yes

  No

  N/A

• What is the temperature setting?

• What are the hours of operation?

• Is the server room cooled by regular building AC?

  Yes

  No

  N/A

• What is the temperature setting?

• What are the hours of Operation?

• Is the server room adequately ventilated?

  Yes

  No

  N/A

• Is there a Temperature Monitor/Sensor in the local UPS’s? (verify with IT Ops)

  Yes

  No

  N/A

• Where & how? (i.e., Dedicated or Part of another device)

• Does the Server Room have dedicated power circuits?

  Yes

  No

  N/A

• Are all power cables/wires in the server room covered to prevent trip hazards?

  Yes

  No

  N/A

• Is there a fully-charged/certified Class C fire extinguisher in the server room?

  Yes

  No

  N/A

• When was it last inspected?

  Date

• Is it Expired?

  Yes

  No

  N/A

• Is the server room and area around the server free from clutter, boxes or paper?

  Yes

  No

  N/A

• Are there old laptops (or other IT equipment) stored in the server room?

  Yes

  No

  N/A

• Are they just stored in the room or additionally secured?

• Is there non-IT equipment stored in the server room?

  Yes

  No

  N/A

• Sweep the Server Room?

  Yes

  No

  N/A

Protecting against external and environmental threats

• Is there an Emergency Power Shutoff Switch in the server room?

  Yes

  No

  N/A

Equipment Maintenance

• Is all the Server/Enterprise network equipment under maintenance contract?

  Yes

  No

  N/A

Cabling Security

• Are Server Rooms in the facility secured 24/7?

  Yes

  No

  N/A

• Are Telecom rooms in the facility secured 24/7?

  Yes

  No

  N/A

• Is the Server/Switch in an Open Area?

  Yes

  N/A

• Is the Server/Network Equipment in a locked Cabinet?

  Yes

  No

  N/A

• What type of Lock – Key, Code, Other?

  Key

  Code Lock

  Other

• Is the rack locked?

  Yes

  No

  N/A

• Who has access?

• Where are keys stored?

• Is there an alerting mechanism when the cage is opened?

  Yes

  No

  N/A

• If there is camera/video surveillance in the office, is the server/network equipment/cabinet being monitored?

  Yes

  No

  N/A

• Does the Facility AC operate 24/7?

  Yes

  No

  N/A

• What hours does the AC Operate?

• Is there a Spot Cooler to supplement?

  Yes

  No

  N/A

• Does water need to be manually dumped?

  Yes

  No

  N/A

• What is the temperature setting?

• Is there a Temperature Monitor/Sensor in the Local UPS? (Verify with IT OPS)

  Yes

  No

  N/A

• Does the Server/Network equipment have dedicated power circuits?

  Yes

  No

  N/A

• Are 3rd party individuals requesting access to the equipment /rack escorted or monitored at all times?

  Yes

  No

  N/A

• Are all power cables/wires covered/secured to prevent trip hazards?

  Yes

  No

  N/A

• Are monitors/keyboards for connecting to servers secured when not in use? i.e., Not Connected

  Yes

  No

  N/A

• Is all the Server/Enterprise network equipment under maintenance contract?

  Yes

  No

  N/A

• Servers / switches stored outside of a Server Room and not in an open area? i.e., running in a closet, office, etc…

  Yes

  N/A

• If there is camera/video surveillance in the office, is the server/network equipment/being monitored?

  Yes

  No

  N/A

• Does the Facility AC operate 24/7?

  Yes

  No

  N/A

• What hours does the AC Operate?

• Is there a Spot Cooler to supplement?

  Yes

  No

  N/A

• Does water need to be manually dumped?

  Yes

  No

  N/A

• What is the temperature setting?

• Is there a Temperature monitor/sensor in the local UPS? (Verify with IT OPS)

  Yes

  No

  N/A

• Does the server/network equipment have dedicated power circuits?

  Yes

  No

  N/A

• Are 3rd party individuals requesting access to the equipment/rack escorted or monitored at all times?

  Yes

  No

  N/A

• Are all power cables/wires covered/secured to prevent trip hazards?

  Yes

  No

  N/A

• Are monitors/keyboards for connecting to servers secured when not in use? i.e., not connected.

  Yes

  No

  N/A

• Is all the Server / Enterprise network equipment under maintenance contract?

  Yes

  No

  N/A