IT Security Audit Checklist

Everything you need to plan and run an internal IT security audit: a 120-point checklist you can tick through on site, and the templates to plan the audit, record findings and track corrective actions to closure.

An IT security audit is not a penetration test. A penetration test looks for holes in one target; an audit checks that the controls you say you have are in place, are followed and actually work, across the whole environment. This kit is built for that job.

What is inside

IT Security Audit Checklist — 120 checks in 12 control areas: governance and risk, asset management, identity and access, network security, endpoints and servers, vulnerability and patch management, data protection, logging and monitoring, incident management, backup and recovery, change and suppliers, people and physical security. Each check has Yes / No / N/A boxes and space for evidence.

IT Audit Plan and Findings Log — audit plan, risk-based scoping table, timetable, findings log with grading guidance, corrective action tracker and a report outline.

Both documents as a designed, print-ready PDF and as an editable Word file.

Who it is for

IT managers, internal auditors, information security officers and consultants — and anyone preparing for an ISO/IEC 27001 internal audit who wants a practical starting point.

How to use it

Plan the audit with the template, spend the most time where the risk is highest, and look for evidence for every check rather than accepting that something is done. For each No, write a finding that states the requirement, the evidence and why it does not conform, then agree an owner and a date.